Summary

  • Revision 20 of the RATS working-group interaction-model draft adds an example of retrieving endorsements with an implicit handle. The query URL stays stable so equivalent requests can share a cache entry.
  • The example binds the query and an expiration time into the signed result. The verifier still decides whether the reference material and the device evidence satisfy its appraisal policy.

The drawer stays put; the answer ages

An attester sends evidence about its state. The verifier needs to know when that evidence was made. Endorsements and reference values have another rhythm: a producer can issue them once, and many verifiers can ask for the same material before it changes. In the RATS architecture, these are different roles and artifacts. Treating every lookup like a fresh challenge would turn a useful cache into a queue at the producer’s door.

The 28 October RATS interaction-model draft is still a working-group Internet-Draft, intended for the Standards Track. Its new Appendix B offers an example rather than a deployment report or a new mandatory protocol. It borrows CoSERV, a separate draft for fetching endorsements and reference values, and asks what happens if a handle must be attached to every such transaction.

A unique handle would make identical requests different. CoSERV deliberately excludes timestamps and other volatile fields from queries. The same environment identifiers and claim selection produce the same encoded query and the same URL path. HTTP can use that path as a cache key. This is the unglamorous part of the design that makes repeated verification affordable: a reference document can be retrieved without making its producer answer every verifier from scratch.

Appendix B assigns the stable URL a second job. In its example, attEnvIDs and claimSelection map to the environment query; the GET URL acts as an implicit handle at the start of an epoch. The producer signs the endorsements and reference values with the query and an expiration timestamp. The timestamp closes that result’s usable period. The draft assumes a reliable time source for the role supplying that boundary, with an Epoch Bell given as one example. The URL routes the question. The signed answer and its deadline tell the verifier which version of the answer it received.

CoSERV’s own text sharpens the economics. Every result set has an expiry, and the consumer must stop treating it as valid afterward. An HTTP cache must not claim a freshness lifetime beyond that expiry. Where untrusted intermediaries are present, the signed response binds the result to the query. A consumer needing a fresh trip to the origin can send Cache-Control: no-cache. Stable addressing does not grant a drawer eternal authority over its contents.

The power to set the reference values and their expiry lies with the supplying role. The verifier controls its own appraisal policy and decides how to use the result beside fresh device evidence. A relying party then decides what an attestation result permits. The appendix gives those actors a common retrieval picture. It does not make a reusable URL the judge of a machine’s current state.

Sources: RATS interaction-model draft -20; prior -19; Datatracker status; CoSERV -07; Epoch Markers -06; RATS architecture, RFC 9334.