Summary

  • The 2 November LAKE working-group draft requests two EDHOC External Authorization Data labels, one for background checks and one for the passport model. July's revision requested four, including two separate trigger labels.
  • A relying party can now start either model by sending CBOR true (0xF5) under that model's label in EDHOC message_1; the attester must answer with a proposal under the same label in message_2.
  • The two labels remain TBD1 and TBD2 in the draft. IANA's live registry has not assigned them.

Two boxes, four meanings

The older proposal gave a trigger its own nameplate. A receiver could distinguish “start a background check” from background-check material by registry label alone. Revision 07 retires that arrangement. It asks IANA for only Remote Attestation BG and Remote Attestation PP. Each label carries a trigger as well as the proposal, request and evidence or result that follow. The July text asked for two additional labels named Trigger Remote Attestation BG and Trigger Remote Attestation PP.

The new trigger is deliberately tiny: the CBOR simple value true, encoded 0xF5. In a relying-party-initiated background check, it appears with the BG label in message_1; the attester must return an attestation proposal in message_2. The passport model uses its PP label and the same first-two-message pattern, but leads to an attestation result issued by a verifier rather than raw evidence for a verifier to appraise. A parser that keys only on the label will miss the change in meaning. It has to read the value and the message stage.

That distinction matters when a constrained device is asked to prove its state while establishing a secure association. The relying party chooses the appraisal route, receives the answer and decides what access follows. The draft also says the relying party is trusted to select an evidence type according to deployment policy. The registry entry is a compact wire identifier; the authority to decide which evidence counts sits elsewhere.

This is a working-group Internet-Draft, listed as I-D Exists in the LAKE document record. The IANA EDHOC registry currently lists no Remote Attestation BG or PP assignment. Neither a registered label nor a deployed implementation is established by the new text.