Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add stateless nonces #13

Merged
merged 1 commit into from
Mar 9, 2023
Merged

add stateless nonces #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions cddl/epoch-marker.cddl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,3 +21,4 @@ $tagged-epoch-id /= #6.26981(TST-info-based-on-CBOR-time-tag)
$tagged-epoch-id /= #6.26982(multi-nonce)
$tagged-epoch-id /= #6.26983(multi-nonce-list)
$tagged-epoch-id /= #6.26984(strictly-monotonic-counter)
$tagged-epoch-id /= #6.26985(stateless-nonce)
1 change: 1 addition & 0 deletions cddl/frag.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,5 +6,6 @@ EPOCH_MARKER_FRAGS += multi-nonce.cddl
EPOCH_MARKER_FRAGS += strictly-monotonic-counter.cddl
EPOCH_MARKER_FRAGS += tst-info.cddl
EPOCH_MARKER_FRAGS += non-empty.cddl
EPOCH_MARKER_FRAGS += stateless-nonce.cddl

EPOCH_MARKER_EXAMPLES := $(wildcard examples/*.diag)
19 changes: 19 additions & 0 deletions cddl/stateless-nonce.cddl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
stateless-nonce = [
TimeToken
AuthTag: bstr .size 20
]

; AuthTag is the HMAC w/ SHA-1 computed over the CBOR serialisation of
; TimeToken

TimeToken = (
Version: bytes .size 1
KeyID: bytes .size 1
Timestamp: posix-time
Pad: bytes
)

; Pad carries no meaning; it is just pad bytes to make stateless-nonce
; the desired size

posix-time = #6.1(int)
12 changes: 12 additions & 0 deletions draft-birkholz-rats-epoch-markers.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,6 +197,18 @@ The counter context is defined by the Epoch bell.
{::include cddl/strictly-monotonic-counter.cddl}
~~~~

### Stateless Nonce

In a highly available service (e.g., a cloud attestation verifier) having to
keep per-session nonce state poses scalablity problems. An alternative is to
use time synchronised servers that share a symmetric key and let which produce
and consume nonces based on coarse-grained clock ticks signed using the shared
secret.

~~~~ CDDL
{::include cddl/stateless-nonce.cddl}
~~~~

# Security Considerations

TODO
Expand Down