Arm's Platform Security Architecture (PSA) Attestation Token
draft-tschofenig-rats-psa-token-08
RATS H. Tschofenig
Internet-Draft S. Frost
Intended status: Informational M. Brossard
Expires: 25 September 2021 A. Shaw
T. Fossati
Arm Limited
24 March 2021
Arm's Platform Security Architecture (PSA) Attestation Token
draft-tschofenig-rats-psa-token-08
Abstract
The Platform Security Architecture (PSA) is a family of hardware and
firmware security specifications, as well as open-source reference
implementations, to help device makers and chip manufacturers build
best-practice security into products. Devices that are PSA compliant
are able to produce attestation tokens as described in this memo,
which are the basis for a number of different protocols, including
secure provisioning and network access control. This document
specifies the PSA attestation token structure and semantics.
The PSA attestation token is a profiled Entity Attestation Token
(EAT).
This specification describes what claims are used in an attestation
token generated by PSA compliant systems, how these claims get
serialized to the wire, and how they are cryptographically protected.
Note to Readers
Source for this draft and an issue tracker can be found at
https://github.com/thomas-fossati/draft-psa-token
(https://github.com/thomas-fossati/draft-psa-token).
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Tschofenig, et al. Expires 25 September 2021 [Page 1]
Internet-Draft PSA Attestation Token March 2021
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 25 September 2021.
Copyright Notice
Copyright (c) 2021 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Simplified BSD License text
as described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Conventions and Definitions . . . . . . . . . . . . . . . . . 3
2.1. Glossary . . . . . . . . . . . . . . . . . . . . . . . . 3
3. PSA Claims . . . . . . . . . . . . . . . . . . . . . . . . . 4
3.1. Caller Claims . . . . . . . . . . . . . . . . . . . . . . 4
3.1.1. Nonce . . . . . . . . . . . . . . . . . . . . . . . . 4
3.1.2. Client ID . . . . . . . . . . . . . . . . . . . . . . 5
3.2. Target Identification Claims . . . . . . . . . . . . . . 5
3.2.1. Instance ID . . . . . . . . . . . . . . . . . . . . . 5
3.2.2. Implementation ID . . . . . . . . . . . . . . . . . . 6
3.2.3. Certification Reference . . . . . . . . . . . . . . . 6
3.3. Target State Claims . . . . . . . . . . . . . . . . . . . 6
3.3.1. Security Lifecycle . . . . . . . . . . . . . . . . . 7
3.3.2. Boot Seed . . . . . . . . . . . . . . . . . . . . . . 8
3.4. Software Inventory Claims . . . . . . . . . . . . . . . . 8
3.4.1. Software Components . . . . . . . . . . . . . . . . . 8
3.4.2. No Software Measurements . . . . . . . . . . . . . . 10
3.5. Verification Claims . . . . . . . . . . . . . . . . . . . 11
3.5.1. Verification Service Indicator . . . . . . . . . . . 11
3.5.2. Profile Definition . . . . . . . . . . . . . . . . . 11
4. Backwards Compatibility Considerations . . . . . . . . . . . 12
5. Token Encoding and Signing . . . . . . . . . . . . . . . . . 12
6. Freshness Model . . . . . . . . . . . . . . . . . . . . . . . 12
7. Collated CDDL . . . . . . . . . . . . . . . . . . . . . . . . 13
Show full document text