Subject: [Rats] Hypothetical example of trust establishment

From: Laurence Lundblade <[email-masked]>
Date: Thu, 8 Aug 2019 10:07:31 -0700

Here’s a hypothetical example of how I think trust is established in RATS. It’s only one of many possible means.

This example uses the term manufacturer, for the organization that builds the chip, the OS for the chip, the attestation implementation and the final product assembly. Say it’s an IoT sensor. The manufacturer builds everything from scratch. I’m depicting this way to keep the example simple.

During Manufacturing of the sensor
The manufacturer designs the sensor and builds prototypes
They receive some certification for their sensor design
They make the chip, the OS and attestation implementation
They generate the attestation key pair and signs public key into an X.509 cert and sign it under their attestation root for the particular sensor product and certification.
They put the private key and X.509 cert into the sensor
The sensor ships to the customer

Manufacturer Publication
The manufacturer publishes the following about their sensor:
Model number and product description
Certifications received probably with link to certifying organization so it can be checked
Attestation root X.509 certificate for that product and certification level

The Attestation is Produced
The nonce is received from the verifier/RP and input into the attestator
The claims are created
The token is signed with the attestation signing private key
The X.509 cert with the public key is put in the right COSE/JOSE header
The token is transmitted to the verifier/RP

The RP Decides Whether to Trust for Their Particular Use Case
The RP decides what types of certifications are good for their use case
The RP fetches the attestation roots from manufacturers with such products and certifications
The attestation is received from the sensor with X.509 cert
They chain up the individual sensor cert to the trusted manufacturer's attestation root

Some other variants might use a more elaborate X.509 hierarchy. Others might not use X.509 at all with the manufacturer operating a public key look up service based on key ID. There might even be some third parties that brokers trust for multiple manufacturers and certification types.

Some of this may have manual out-of-band steps to set up the initial trust of the manufacturer. (I think this may be akin to a user downloading a web browser with CA roots embedded, the basis of a lot of TLS trust).

There might be other criteria than certification. It might just be enough to know it is a particular manufacturer and model based on the signing keys.

LL