Technical Summary
The Conceptual Messages introduced by the RATS Architecture (RFC9334)
are protocol-agnostic data units that are conveyed between RATS roles
during remote attestation procedures. Conceptual Messages describe
the meaning and function of such data units within RATS data flows
without specifying a wire format, encoding, transport mechanism, or
processing details. The initial set of Conceptual Messages is
defined in Section 8 of RFC9334 and includes Evidence, Attestation
Results, Endorsements, Reference Values, and Appraisal Policies.
This document introduces the Conceptual Message Wrapper (CMW) that
provides a common structure to encapsulate these messages. It
defines a dedicated CBOR tag, corresponding JSON Web Token (JWT) and
CBOR Web Token (CWT) claims, and an X.509 extension.
This allows CMWs to be used in CBOR-based protocols, web APIs using
JWTs and CWTs, and PKIX artifacts like X.509 certificates.
Additionally, the draft defines a media type and a CoAP content
format to transport CMWs over protocols like HTTP, MIME, and CoAP.
The goal is to improve the interoperability and flexibility of remote
attestation protocols. By introducing a shared message format like
the CMW, we can consistently support different attestation message
types, evolve message serialization formats without breaking
compatibility, and avoid having to redefine how messages are handled
in each protocol.
Working Group Summary
Reviews and comments were received from many WG members, coming from many
backgrounds (e.g., IoT, confidential computing, PKIX) through the IETF
meetings, mailing list, and GitHub, resulting in lots of progress. This
feedback has brought improvements to the security and privacy considerations,
the design and semantics of newly proposed data structures, accuracy and
correctness of sections written in formal languages (e.g., CDDL), alignment
with other dependent drafts, and so on.
There is strong consensus among interested participants.
Document Quality
The "Implementation Status" section of the document lists two existing
implementation: a Go one [Veraison-Go] and a Rust one [Veraison-Rust] which
cover all the features in the draft and are currently alpha-status.
The ASN.1 module for the X.509 extension has been reviewed and validated using
available tooling to check it compiles correctly [ASN1-check]. ASN.1 extension
request has been verified by IANA Designated Expert [ASN1-request].
The CDDL and ABNF included in the draft, and the associated ABNF specification,
have been reviewed and refined repeatedly, e.g. [ABNF-fix], [CBOR-tag-CDDL].
CDDL is validated on the draft repo CI (part of the `build` job in [CDDL-CI]),
and the standalone module is published alongside the draft version it belongs
to (e.g., [CDDL-module]).
Media Type Registration Requested on 25 Aug 2025:
https://mailarchive.ietf.org/arch/msg/media-types/VUzse4NM6yhSq8454bcGS5OsH2I/
Personnel
The Document Shepherd for this document is Ionuț Mihalcea. The
Responsible Area Director is Deb Cooley.