I-D Action: draft-reddy-rats-key-binding-02.txt

Internet-Draft draft-reddy-rats-key-binding-02.txt is now available.

   Title:   Key Attestation for Entity Attestation Tokens (EAT)
   Authors: Tirumaleswar Reddy
            Hannes Tschofenig
            Thomas Fossati
            Ionut Mihalcea
            Henk Birkholz
   Name:    draft-reddy-rats-key-binding-02.txt
   Pages:   23
   Dates:   2026-08-15

Abstract:

   This document defines an Entity Attestation Token (EAT) profile and a
   new EAT claim that convey the subject public key and its protection
   properties within attestation evidence.  Combined with protocol-level
   proof of possession from the surrounding protocol, this establishes a
   cryptographic binding between a private key and an attested execution
   environment.

   The subject public key is conveyed using the EAT cnf claim defined in
   [RFC8747] and [RFC7800], and freshness uses the EAT eat_nonce claim
   defined in [RFC9711].  The proof of possession of the subject key is
   obtained from the surrounding protocol, such as TLS certificate-based
   authentication or CSR signature verification.  Because the EAT is
   signed by a hardware-backed Attestation Key (AK), successful
   verification of the EAT signature together with protocol-level proof
   of possession establishes a cryptographic binding between the private
   key and the attested platform state.  This mechanism addresses key
   substitution attacks that arise when attestation evidence and the
   certificate private keys are validated independently.

The IETF datatracker status page for this Internet-Draft is:
https://datatracker.ietf.org/doc/draft-reddy-rats-key-binding/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-reddy-rats-key-binding-02.html

A diff from the previous version is available at:
https://author-tools.ietf.org/iddiff?url2=draft-reddy-rats-key-binding-02

Internet-Drafts are also available by rsync at:
rsync.ietf.org::internet-drafts


_______________________________________________
I-D-Announce mailing list -- [email protected]
To unsubscribe send an email to [email protected]