Subject: [Rats] Pre-allocation code point consensus - was: Self-appraisal (was Re: Meaning of security level claim)

From: "Smith, Ned" <[email-masked]>
Date: Tue, 8 Feb 2022 16:05:42 +0000

I assume the list is comfortable with the other pre-allocation code points besides security level since there has been no discussion about them recently.

Also note that the original list of pre-allocation code points https://mailarchive.ietf.org/arch/msg/cwt-reg-review/vHyIIiFsBG-eON0VaLxlMDFY9S4/ does not include: sueids, hardware-model, hardware-version

Is there anyone that objects to requesting these additional three pre-allocation code points?

Thanks,
Ned

On 2/8/22, 1:22 AM, "RATS on behalf of Henk Birkholz" <[email-masked] on behalf of [email-masked]> wrote:

    Hi Laurence,

    and yet this example was provided by Giri:

    > Sec Level = 1:  Lowest level of security assurance.  No 3rd-party validation of TOE.
    > 
    > Sec Level = 2:  FIDO Levels 1/1+, SESIP Level 1, ARM PSA Cert Level 1
    > 
    > Sec Level = 3:  FIDO Level 2, SESIP Level 2, ARM PSA Cert Level 2
    > 
    > Sec Level = 4:  FIDO Level 3/3+ or higher, SESIP Level 3, ARM PSA Cert Level 3

    where:

    1.) FIDO levels are literally "Authenticator Certification Levels"
    2.) SESIP Assurance Levels represent a level of certification (where 1-3 
    are basically these "self-assertions" and 4-5 are kind of endorsed, I 
    think?)
    3.) PSA literally has "Cert" in the quote

    So... yeah. I get why this definitely looks like a "certification-level" 
    and/or(!) a "security-self-declaration" (especially as SESTP literally 
    reads like it is both). Consecutively, I am increasingly having doubts 
    about the current definition of "security-level" and I think I am as 
    least as confused as Eric, Ned, and Wei are. Which raises a big red flag 
    for me.

    Additionally, a problem that I see today (and that has not been visible 
    in -09 of EAT, I think) is that you can just put these Claims in 
    Attestation Results or Evidence and have no way that helps you to 
    understand where these Claims are coming from really, which could be 
    misleading and actually even be harmful to the Relying Party.

    I am mostly okay with the other claims even (and am relatively neutral 
    on other self-assertions, such as "secure-boot-label" or 
    "debug-status-label").

    If this block is the target:

    > 
    > nonce-label = 10
    > ueid-label = 256
    > sueids-label = 257
    > oemid-label = 258
    > hardware-model-label = 259
    > hardware-version-label = 260
    > security-level-label = 261
    > secure-boot-label = 262
    > debug-status-label = 263
    > location-label = 264
    > profile-label = 265
    > submods-label = 266

    I'd be leaning towards removing security-level from that list.

    Viele Grüße,

    Henk

    On 08.02.22 04:53, Laurence Lundblade wrote:
    > Hi Panwei,
    > 
    >> On Feb 7, 2022, at 7:47 PM, Panwei (William) 
    >> <[email-masked] <mailto:[email-masked]>> wrote:
    >>
    >> To me, the “security-level” seems like redundant with the DLOA claim, 
    >> because I feel they are both related to security certification schemes 
    >> such as FIPS and Common Criteria.
    > 
    > The text defining security-level explicitly says it is NOT about 
    > certification.
    > 
    > LL
    > 
    > 
    > _______________________________________________
    > RATS mailing list
    > [email-masked]
    > https://www.ietf.org/mailman/listinfo/rats

    _______________________________________________
    RATS mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/rats

---

From: Michael Richardson <[email-masked]>
Date: Wed, 09 Feb 2022 13:36:09 -0500

Smith, Ned <[email-masked]> wrote:
    > I assume the list is comfortable with the other pre-allocation code
    > points besides security level since there has been no discussion about
    > them recently.

    > Also note that the original list of pre-allocation code points
    > https://mailarchive.ietf.org/arch/msg/cwt-reg-review/vHyIIiFsBG-eON0VaLxlMDFY9S4/
    > does not include: sueids, hardware-model, hardware-version

    > pre-allocation code points?

None from me.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide