Attestation Attributes for Use with Certification Signing Requests

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 9 December 2023.¶

Copyright Notice

Copyright (c) 2023 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

2. Definitions

The following definitions should be used in the context of this document primarily to understand the relationship of an attestation to the ASN.1 structures used to carry an attestation in PKIX structures. As of the date of this document, the IETF lacked a common nomenclature for attestation-related terms.¶

Attestation Engine

The secure hardware and firmware used to compose and sign an attestation.¶

Attestation Key

Either the private key used to sign an attestation statement, or the related public key used to verify the attestation statement, depending on context.¶

Attester

The entity that directs the creation of an attestation statement and who owns, controls, or is permitted to use the private attestation key.¶

Ancillary Attestation Data

Any data provided from a source external to the attestation engine as part of the creation of an attestation statement and/or any additional data needed for the verification of an attestation statement. The externally provided data could be a relying party originated nonce, a time stamp, session information or other data meant to be bound in time to the attestation statement. Other additional data may be an internally formatted key, or other data needed to bridge between the attestation statement and PKIX or other relying or interpretating regimes. The format of externally provided data is not under the control of the attestation engine, but may need to be transformed, such as by hashing, before it may be incorporated within the attestation statement processing. For example, a relying party may need both the "externalData" argument for the TPM 2.0 TPM2_Certify command, and the TPMT_PUBLIC structure containing the key being certified to verify an attestation.¶

Attestation Statement

The object, any optional ancillary data incorporated during the creation of that object, and the signature over that object, created by an attestation engine at the request of an Attester to provide evidence of a fact or set of facts within the cognizance of the attestation engine at a particular point in time." Sometimes referred to simply as an "attestation".¶

Attestation

The implicit or explicit collection of an attestation statement, any ancillary data, an attestation key, and a chain of trust for that key. By convention, this contains at least the minimum data needed to cryptographically validate an attestation statement and extract any policy meaning.¶

Key Attestation

An attestation created with respect to a particular key or key pair.¶

3. ASN.1 Elements

-- Root of IETF's PKIX OID tree
id-pkix OBJECT IDENTIFIER ::= { iso(1) identified-organization(3)
     dod(6) internet(1) security(5) mechanisms(5) pkix(7) }

-- S/Mime attributes - can be used here.
id-aa OBJECT IDENTIFIER ::= {iso(1) member-body(2) usa(840)
     rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) attributes(2)}


-- Branch for attestation statement types
id-ata OBJECT IDENTIFIER ::= { id-pkix (TBD1) }

CertificateChoice ::=
   CHOICE {
      cert Certificate, -- typical X.509 cert
      opaqueCert    [0] IMPLICIT OCTET STRING, -- Format implicitly agreed upon
                                                        -- by sender and receiver
      typedCert     [1] IMPLICIT TypedCert,
      typedFlatCert [2] IMPLICIT TypedFlatCert
   }

TYPED-CERT ::= TYPE-IDENTIFIER -- basically an object id and a matching ASN1
                               -- structure encoded as a sequence
CertType ::= TYPED-CERT.&id

TypedCert ::= SEQUENCE {
              certType     TYPED-CERT.&id({TypedCertSet}),
              content     TYPED-CERT.&Type ({TypedCertSet}{@certType})
          }

TypedCertSet TYPED-CERT ::= {
             ... -- Empty for now,
             }

TypedFlatCert ::= SEQUENCE {
    certType OBJECT IDENTIFIER,
    certBody OCTET STRING
}

id-aa-attestStatement OBJECT IDENTIFIER ::= { id-aa (TBDAA2) }

AttestAttribute ATTRIBUTE ::= {
  TYPE AttestStatement
  IDENTIFIED BY id-aa-attestStatement
}

id-aa-attestChainCerts OBJECT IDENTIFIER ::= { id-aa (TBDAA1) }

attestCertsAttribute ATTRIBUTE ::= {
  TYPE SEQUENCE OF CertificateChoice
  COUNTS MAX 1
  IDENTIFIED BY id-aa-attestChainCerts
}

ATTEST-STATEMENT ::= CLASS {
  &id                 OBJECT IDENTIFIER UNIQUE,
  &Type,                  -- NOT optional
  &algidPresent       ParamOptions DEFAULT absent,
  &sigPresent         ParamOptions DEFAULT absent,
  &ancillaryPresent   ParamOptions DEFAULT absent,
  &sigType            DEFAULT OCTET STRING
  &ancillaryType      DEFAULT OCTET STRING

} WITH SYNTAX {
  TYPE  &Type
  IDENTIFIED BY &id
  [ALGID IS &algidPresent]
  [SIGNATURE [TYPE &sigType] IS &sigPresent]
  [ANCILLARY [TYPE &ancillaryType] IS &ancillaryPresent]
}

AttestStatement { ATTEST-STATEMENT:IOSet}  ::= SEQUENCE
  {
    type          ATTEST-STATEMENT.&id({IOSet}),
    value         ATTEST-STATEMENT.&Type({IOSet}{@type}),
    algId         [0] IMPLICIT  AlgorithmIdentifier OPTIONAL,
    signature     [1] ATTEST-STATEMENT.&sigType OPTIONAL -- NOT implicit
    ancillaryData [2] ATTEST-STATEMENT.&ancillaryType OPTIONAL
  }

MyOpaqueSignature ::= OCTET STRING

ECDSA-Sig-Value ::= SEQUENCE {
  r  INTEGER,
  s  INTEGER
}

4. IANA Considerations

The IANA is requested to open one new registrie, allocate a value from the "SMI Security for PKIX Module Identifier" registry for the included ASN.1 module, and allocate values from "SMI Security for S/MIME Attributes" to identify two Attributes defined within.¶

5. Security Considerations

The attributes and structures defined in this document are primarily meant to be used as additional Attributes for a PKCS10 Certification Signing Request (CSR). As such, it's up to the receiving/relying party to place as much or as little trust in the contents of these attributes as necessary to satisfy its own policies.¶

A relying party will need either a specification defining how an attestation type was formed and how to validate that type, or a trusted method of verifying the attestation. In the former case, a relying party should consider the information available from any certificate chain covering the attesting key when deciding to accept the attestation.¶

Most attestations will need to provide a method to convert the attested key representation into the equivalent SubjectPublicKey info structure and the attested key MUST be compared for equivalence to the public key provided in the CSR before accepting the attestation.¶

The relying party, as always, is responsible for setting the rules for what it will accept. The presence of an AttestAttribute is not required by any current standard, but such attribute may provide the relying party with additional assurance as a prerequisite to issuing certificates or other credentials. That acceptance criteria is out of scope for this document. Whether to require an AttestAttribute or its contents in any specific use case is out-of-scope for this document.¶

Appendix A. Examples

-- This OCTET STRING is not like any other OCTET STRING
-- Please see https://example.com/simple-attest.txt,
-- Structure labled "Mike's simple attest" for the
-- structure of this field and how to verify the attestation

MikesSimpleAttestData ::= OCTET STRING

mikesSimpleAttestOid OBJECT IDENTIFIER ::= { id-mikes-root 1 }

MikesSimpleAttest ATTEST-STATEMENT ::= {
  TYPE MikesSimpleAttestData
  IDENTIFIED BY mikesSimpleAttestOid
  -- These are all implied
  -- ALGID IS absent
  -- SIGNATURE is absent
  -- ANCILLARY is absent
}

-- IMPORT these.
-- PKI normal form for an ECDSA signature
ECDSA-Sig-Value ::= SEQUENCE {
  r INTEGER,
  s INTEGER
  }

-- Octet string of size n/8 where n is the
-- bit size of the public modulus
RSASignature ::= OCTET STRING

-- One or the other of these depending on the value in TPMT_SIGNATURE
TpmSignature CHOICE ::= {
  ecSig [0] IMPLICIT ECDSA-Sig-Value,
  rsaSig [1] IMPLICIT RSASignature
  }

-- The TPM form of the public key being attested.
-- Needed to verify the attestation - this is the TPMT_PUBLIC structure.
TpmtPublic ::= OCTET STRING

-- The TPMS_ATTEST structure as defined in TPM2.0
-- Unwrapped from the TPM2B_ATTEST provided
-- by the TPM2_Certify command.
TpmsAttest ::= OCTET STRING

-- The qualifying data provided to a TPM2_Certify call, may be absent
-- This is the contents of data field of the TPM2B_DATA structure.
QualifyingData ::= OCTET STRING

TpmAncillary ::= SEQUENCE {
   toBeAttestedPublic TpmtPublic,
   qualifyingData QualifyingData OPTIONAL
   }

-- This represents a maximally unwrapped TPM V2.0 attestation.  The
-- output of TPM2_Certify is a TPM2B_ATTEST and a TPMT_SIGNATURE.
-- The former is unwrapped into a TPMS_ATTEST and the latter is
-- decomposed to provide the contents of the algId and signature fields.

--
-- This attestation statement can be verified by:
-- Signature siggy = Signature.getInstance (stmt.algId);
-- siggy.init (attestPublicKey, VERIFY);
-- siggy.update ((short)stmt.value.length) // todo: big or little endian
-- siggy.update (stmt.value.data)
-- bool verified = siggy.verify (getSigData(stmt.signature)); //
unwrap the signature
--

TpmV2AttestStatement ATTEST STATEMENT ::= {
   TYPE TpmsAttest
   IDENTIFIED BY id-ata-tpmv20-1
   ALGID IS present
   SIGNATURE TYPE TpmSignature IS present
   ANCILLARY TYPE TpmAncillary IS present
   }

Appendix B. ASN.1 Module for Attestation

The following module imports definitions from modules defined in [RFC5912] and [RFC8551].¶

IANA Note: Please replace TBDMOD, TBD1 and TBD2 with assigned values.¶

-- This module provides a definition for two attributes thay may be
-- used to carry key attestation information within a
-- CertificationSigningRequest (aka PKCS10), or for other purposes.

-- IANA - Value needed
Attest-2023
    {iso(1) identified-organization(3) dod(6) internet(1) security(5)
    mechanisms(5) pkix(7) id-mod(0) id-mod-pkix-attest-01(TBDMOD) }

DEFINITIONS EXPLICIT TAGS ::=
BEGIN

IMPORTS

Attribute, SingleAttribute, id-pkix, Certificate
FROM PKIX1Explicit-2009
      {iso(1) identified-organization(3) dod(6) internet(1)
      security(5) mechanisms(5) pkix(7) id-mod(0)
      id-mod-pkix1-explicit-02(51)}

ATTRIBUTE,AttributeSet
FROM PKIX-CommonTypes-2009
    {iso(1) identified-organization(3) dod(6) internet(1) security(5)
     mechanisms(5) pkix(7) id-mod(0) id-mod-pkixCommon-02(57)}

ParamChoice
FROM AlgorithmInformation-2009
    {iso(1) identified-organization(3) dod(6) internet(1) security(5)
    mechanisms(5) pkix(7) id-mod(0)
    id-mod-algorithmInformation-02(58)}

id-aa
FROM SecureMimeMessageV3dot1
     { iso(1) member-body(2) us(840) rsadsi(113549)
        pkcs(1) pkcs-9(9) smime(16) modules(0) msg-v3dot1(21) }

-- Repeated here for easy reference.
--   id-aa OBJECT IDENTIFIER ::= {iso(1) member-body(2) usa(840)
--      rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) attributes(2)}


-- IANA - Values needed
-- Branch for attestation statement types
id-ata OBJECT IDENTIFIER ::= { id-pkix (TBD1) }

-- A general comment is that a certificate is a signed binding between
-- public key and some identifying info. Below "cert" is an X.509
-- "Certificate". "opaqueCert" is just string of bytes that the
-- receiving CA must know how to parse given information not carried
-- in this object.  "typedCert" and "typedFlatCert" both use an OID to
-- identify their types, but differ in that the encoding for typedCert
-- is always valid ASN1, whereas the typedFlatCert is just a string of
-- bytes that must be interpreted according to the type.  Note that a
-- typedFlatCert MAY contain an encapsulated ASN1 object, but this is
-- not the best use of the type and is hereby discouraged.

CertificateChoice ::=
   CHOICE {
      cert Certificate, -- typical X.509 cert
      opaqueCert [0] IMPLICIT OCTET STRING,
      typedCert [1] IMPLICIT TypedCert, -- not ASN1 parseable

      typedFlatCert [2] IMPLICIT TypedFlatCert
   }

-- Cribbed from definition of CONTENT-TYPE
-- Alternately as TypedCert ::= SingleAttribute
--
TYPED-CERT ::= TYPE-IDENTIFIER -- object id and a matching ASN1
                               -- structure encoded as a sequence
CertType ::= TYPED-CERT.&id

TypedCert ::= SEQUENCE {
              certType     TYPED-CERT.&id({TypedCertSet}),
              content      TYPED-CERT.&Type ({TypedCertSet}{@certType})
          }

TypedCertSet TYPED-CERT ::=
             ... -- Empty for now,
             }


-- The receiving entity is expected to be able to parse the certBody
-- field given the value of the certType field.  This differs from
-- TypedCert in that the contents of the certBody field are not
-- necessarily well formed ASN1 in this case the certType tells you
-- how to parse the body of the OCTET STRING,

TypedFlatCert ::= SEQUENCE {
    certType OBJECT IDENTIFIER,
    certBody OCTET STRING
}


-- A sequence of certificates used to validate an attestation chain.
-- By convention, the first certificate in the chain is the one that
-- contains the public key used to verify the attestation.  If the
-- related attestStatementAttribute contains more than a single
-- attestation, this attribute is expected to contain all of the
-- certificates needed to validate all attestations

id-aa-attestChainCerts OBJECT IDENTIFIER ::= { id-aa (TBDAA1) }


attestCertCertsAttribute ATTRIBUTE ::= {
        TYPE SEQUENCE OF CertificateChoice
        COUNTS MAX 1
        IDENTIFIED BY id-aa-attestChainCerts
    }

-- If the signature is provided separately, the value field need not
-- contain the signature.  Note that some attestation methods include
-- a signature method in the part signed by the signature and some do
-- not.

ATTEST-STATEMENT ::= CLASS {
  &id                 OBJECT IDENTIFIER UNIQUE,
  &Type,                  -- NOT optional
  &algidPresent       ParamOptions DEFAULT absent,
  &sigPresent         ParamOptions DEFAULT absent,
  &sigType            DEFAULT OCTET STRING
  &ancillaryPresent   ParamOptions DEFAULT absent,
  &ancillaryType      DEFAULT OCTET STRING

} WITH SYNTAX {
  TYPE  &Type
  IDENTIFIED BY &id
  [ALGID IS &algidPresent]
  [SIGNATURE [TYPE &sigType] IS &sigPresent]
  [ANCILLARY [TYPE &ancillaryType] IS &ancillaryPresent]
}

AttestStatement { ATTEST-STATEMENT:IOSet}  ::= SEQUENCE
  {
    type          ATTEST-STATEMENT.&id({IOSet}),
    value         ATTEST-STATEMENT.&Type({IOSet}{@type}),
    algId         [0] IMPLICIT  AlgorithmIdentifier OPTIONAL,
    signature     [1] ATTEST-STATEMENT.&sigType OPTIONAL -- NOT implicit
    ancillaryData [2] ATTEST-STATEMENT.&ancillaryType OPTIONAL
  }

-- An attribute that contains a attestation statement.

id-aa-attestStatement OBJECT IDENTIFIER ::= { id-aa (TBDAA2) }

attestAttribute ATTRIBUTE ::= {
        TYPE AttestStatement
        IDENTIFIED BY id-aa-attestStatement
    }

END

Author's Address