Subject: Re: [EAT] Attestation Model

From: "Smith, Ned" <[email-masked]>
Date: Fri, 7 Sep 2018 00:50:12 +0000

|Here’s an attempt to move the EAT model slightly closer to the RATS model and terminology. |Actual ppt is on GitHub <https://github.com/eat-ietf-wg/eat-slides>;.

The attestation flow is a good start. But it may be relevant to capture the flow of claims (aka token) begins with the manufacturer of the environment that protects the keys (both provisioned at mfg time and subsequently generated during deployment and onboarding).

The mfg may be an ‘authoritative claimant’ regarding key protection properties of the environment, but there can be other claimants too. For example, a common criteria certification lab could also be an authoritative claimant that may assert the same claims as the manufacturer plus additional claims about the CC test results.