Started an agenda for 2023-12-04

meetingNotes/2023-12-04.md

@@ -0,0 +1,29 @@
+# Agenda
+
+1. MikeO presented last week on this work to the CA/B Forum. The talk was well-received. Key points:
+  a. I said that the CSR Attest format to carry existing proprietary attestations should be usable within the year.
+  b. The RATS X.509 Evidence work is probably a couple years away from being usable and will probably have a "new devices only" feel; though in some cases it might be possible to retrofit in-field devices.
+  c. How the trust stores will be managed is an open question. Likely each CA will manage their own, so each HSM vendor will have to work with each CA. It was suggested that PKI Consortium could maintain a wiki linking to each vendor's web page with their attestation root keys and tooling and docs for parsing their attestations.
+
+2. I want to make progress on the Key Evidence claims.
+_imported_: semantically we want this flag to mean "This private key has never in the past existed in plaintext outside an HSM".
+_non-exportable_: semantically we want this flag to mean "This private key can never in the future exist in plaintext outside an HSM".
+
+We want to avoid wording this so that we accidentally forbid backups and HSM clustering (see SP 800-208 fiasco).
+
+Possibly we want our _non-exportable_ to be equivalent to PKCS#11 !CKA_EXTRACTABLE && CKA_NEVER_EXTRACTABLE.
+Does P11 have a concept that can be mapped to our _imported_?
+
+References to draw key properties from:
+* the PKCS#11 spec defines a list of key storage properties. We can borrow that list into this evidence claim.
+    * http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/os/pkcs11-base-v2.40-os.html#_Toc416959720
+    * Looking specifically at Table 27    
+* TPM profile: PSA
+    * https://arm-software.github.io/psa-api/crypto/1.1/api/keys/attributes.html
+    * https://github.com/ARM-software/psa-api/issues/13
+* TPM 2.0
+    * https://trustedcomputinggroup.org/resource/tpm-2-0-keys-for-device-identity-and-attestation/
+
+
+
+# Attendance