ietf-rats-wg / ietf-rats-usecases Goto Github PK

This is an extract of an earlier discussion on the RATS mailing list.

Attestations are great but suffer from the generic PKI problem: Where are the trust anchors ?
The Web PKI is nowadays carefully maintained by the platform vendors. There is no counterpart for TEE attestation keys.

Some organizations are certainly prepared to go an extra mile to create their own repositories of trust anchors.

However, for those who lack incentives for maintaining trust anchor repositories an alternative approach seems feasible:
Add a URL like https://huawei.com/tee-roots to the attested data. Consumers of such a scheme would then only have to configure a list of "trusted device vendors" expressed as Web domains like huawei.com, google.com, apple.com etc. in order to securely retrieve trust anchors and verify attestations. That is, the trust model for this concept is based on 1) device vendor selection 2) the ubiquity of the Web PKI.

The text above is also supposed to qualify as a defensive publication.

I would be interested in co-editing an I-D if there is a reasonable chance getting WG adoption for the work.