Subject: [Rats] Charra: certificate-name vs TPM-name

From: "Eric Voit (evoit)" <[email-masked]>
Date: Tue, 28 Jul 2020 15:30:12 +0000

Hi Wei Pan,

During the RATS WG call you wondered why certificate-name should be used
rather than tpm-name.  There are two reasons:

(1) In RFC places like:

      +---x tpm20-challenge-response-attestation {TPM20}?

         +--ro output

            +--ro tpm20-attestation-response* []

               +--ro certificate-name?           string

               +--ro quote?                              binary

               +--ro quote-signature              binary

if just the tpm-name is provided, how does a Verifier know when a re-keying
happens?    With the current solution, when unknown certificate-name comes
back from the RPC, you just need to query:

    +--rw rats-support-structures

       +--rw tpms* [tpm-name]

          +--rw tpm-name                     string

          +--rw certificates

             +--rw certificate* [certificate-name]

                +--rw certificate-name    string

                +--rw certificate-ref?    leafref

                +--rw certificate-type?   enumeration

and then you can find the tpm-name, plus all the required info
post-certificate upgrade in one place.  If the certificate-name is not in
the RPC, a Verifier will have to make several guesses on what any failure of
signature verification might mean.

(2) The most common implementations will have just one TPM per
router/switch.  These implementations might never care about the tpm-name.
They will care about the certificate used on that router/switch.

Thanks,

Eric

Eric Voit 

.:|:.:|:. Cisco Systems, Inc.