Summary

  • The 27 October revision of an IETF RATS draft identifies seven writable settings that shape a network device's attestation stream, including PCR selection, heartbeat interval and signing configuration.
  • The new security analysis calls for restricted write and subscription access, and treats a missed required notification as a break in the freshness trail.

A security camera can deliver flawless footage of the corner its owner aimed it at. The useful question is who chose the corner. A network device's attestation stream has its own adjustable lens: the PCRs selected for reporting, the heartbeat clock and the certificate associated with notifications. Revision 15 of the RATS subscription draft puts those controls on the security page.

The draft's YANG tree marks seven controls writable. Administrators can set the marshalling period, TPM 1.2 and TPM 2.0 signing schemes, TPM 2.0 heartbeat, subscription AIK certificate name and subscribable PCR indices for each TPM version. A PCR extension can be grouped before a notification; the default marshalling period is five seconds. The heartbeat sends a fresh TPM 2.0 quote even when the selected PCRs have stayed quiet. These are the knobs that determine the stream a verifier receives.

The new Section 8.3 says an unauthorized change can alter the Evidence available, its delivery rate or the keys and algorithms attached to it. It also names the other side of the cabinet: measurement logs, PCR values and platform details exposed to readers of the stream. RFC 8341 supplies a network configuration access-control model; the draft calls for authorized administrators on writes and authorized verifiers or consumers on reads and subscriptions. Its security analysis follows RFC 9907.

Section 8.4 gives silence a cost. When a required notification or heartbeat fails to arrive, the verifier needs fresh Evidence before treating later appraisals as fresh. Repeated measured events can also drive up notification traffic and TPM work. A long-lived subscription has a resource bill as well as a cryptographic signature.

Revision 14 carried a shorter generic security section. The Datatracker places revision 15 in IESG evaluation with AD follow-up. The draft now makes the governing question explicit: who can turn the dials while everyone else watches the pulses?