Subject: [saag] "EAT" proposal for device attestation

From: Laurence Lundblade <[email-masked]>
Date: Thu, 14 Jun 2018 20:08:10 -0700

Hello SAAG,

FYI, Some of us are interested in developing what we call an "Entity Attestation Token” that can provide some assurance about a device to its remote communication peer in a general and standard way.  Attestation similar to this is done by FIDO, BRSKI, Intel EPID, recent versions of the Android key store and other, but they all use different formats.

We’re proposing CBOR and COSE for a general standard format. We have first draft here <https://tools.ietf.org/html/draft-mandyam-eat-00>.

There is a non-WG mailing list for discussion: [email-masked] <mailto:[email-masked]>. It is just getting started so there hasn’t been any discussion yet. I expect the core standards work would be aligning on claims that describe devices, but I’m not sure if folks are familiar with the current schemes out there that I mentioned above and what they do.

I will attend the Montreal IETF and hopefully present a HotRFC. 

Thanks,

LL