Summary

  • Revision 14 makes equal length and position-by-position correspondence mandatory for paired PCR index and value lists in the TPM 1.2 notification structure.
  • The new revision answers a specific representation concern in the June IESG ballot record, but IANA review is again needed and the draft remains in AD follow-up.

Analysis

A reviewer’s data-shape question becomes a protocol rule

In remote attestation, a verifier needs to know which measurement belongs to which Platform Configuration Register (PCR). A value without its register index is incomplete evidence; an index paired with the wrong value can make a structured report harder to interpret. That association is especially important when measurements arrive as a stream rather than in a one-off exchange.

The IETF’s fourteenth revision of Attestation Event Stream Subscription addresses that problem in a narrow but consequential place. In the TPM 1.2 unsigned-pcr-values notification, the draft represents indexes and values as sibling YANG leaf-lists. Revision 14 says the producer must provide the same number of entries in each list and that entry N in one corresponds to entry N in the other. The text makes the pairing rule explicit rather than leaving the receiver to infer how the two sequences align. The current draft is an Internet-Draft intended for Proposed Standard, not an approved RFC.

The change is traceable to a concrete review exchange. In June, an IESG ballot comment on revision 13 questioned the correlation semantics of the two lists, noted the ordering constraint, and asked why a single list structure was not used. The new language does not change the representation into a keyed list. Instead, it places a normative contract around the existing parallel-list shape: equal cardinality and positional correspondence. That gives an implementation a precise conformance question to answer, while preserving the draft’s chosen data model. The ballot record and the revision history show the comment and the subsequent version sequence.

That distinction matters. A MUST statement can reduce ambiguity in what the producer is required to emit; it cannot by itself prove that deployed producers obey it, that every receiver validates it, or that all possible correlation errors disappear. The draft’s TPM 2.0 structure uses a separate keyed pcr-values list, so the TPM 1.2 change should not be generalized to every measurement format in the document.

The procedural status also moved with the new text. Datatracker records revision 14 as uploaded and accepted on 5 October 2026. On that date, the system changed the IANA review state from “IANA OK - Actions Needed” to “Version Changed - Review Needed.” The page still shows IESG Evaluation::AD Followup, three DISCUSS positions, no telechat date, and enough positions to pass once the DISCUSSes are resolved. This is a renewed review checkpoint, not evidence that IANA has rejected the draft or that the IESG has approved it.

The episode illustrates how technical governance operates at the boundary between data structure and institutional review. A reviewer identified uncertainty in how paired values should be read; the authors made the intended correspondence normative; a new version then required the IANA review record to be revisited. The immediate result is greater textual precision and another process step. Whether implementations converge on the requirement, whether the review cycle closes, and whether the draft advances remain open questions.

Sources