Movatterモバイル変換

[0]ホーム
URL:

RFC 9782EAT Media TypesMay 2025
Lundblade, et al.Standards Track[Page]
Stream:
Internet Engineering Task Force (IETF)
RFC:
9782
Category:
Standards Track
Published:
ISSN:
2070-1721
Authors:
L. Lundblade
Security Theory LLC
H. Birkholz
Fraunhofer SIT
T. Fossati
Linaro

RFC 9782

Entity Attestation Token (EAT) Media Types

Abstract

The payloads used in Remote ATtestation procedureS (RATS) may require anassociated media type for their conveyance, for example, when the payloads areused in RESTful APIs.

This memo defines media types to be used for Entity Attestation Tokens (EATs).

Status of This Memo

This is an Internet Standards Track document.

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841.

Information about the current status of this document, any errata, and how to provide feedback on it may be obtained athttps://www.rfc-editor.org/info/rfc9782.

Copyright Notice

Copyright (c) 2025 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.

▲

Table of Contents

1.Introduction

Payloads used in Remote ATtestation procedureS (RATS)[RATS-ARCH] may require anassociated media type for their conveyance, for example, when used in RESTfulAPIs (Figure 1).

RelyingPartyAttesterVerifierPOST/verifyEAT(Evidence)200OKEAT(AttestationResults)POST/authEAT(AttestationResults)201Created
Figure 1:Conveying RATS Conceptual Messages in REST APIs Using EATs

This memo defines media types to be used for EATpayloads[EAT] independently of the RATS Conceptual Message in which theymanifest themselves. The objective is to give protocol, API, and applicationdesigners a number of readily available and reusable media types forintegrating EAT-based messages in their flows, e.g., when using HTTP[BUILD-W-HTTP] or the Constrained Application Protocol (CoAP)[REST-IoT].

1.1.Terminology

This document uses the terms and concepts defined in[RATS-ARCH].

2.EAT Types

Figure 2 illustrates the six EAT wire formats and how they relate toeach other.[EAT] defines four of them (CBOR Web Token (CWT), JSON Web Token (JWT), and the detached EAT bundle inits JSON and CBOR flavours), while[UCCS] defines the Unprotected CWT Claims Set (UCCS) and Unprotected JWT Claims Sets (UJCS).

UJCSUCCSJWTCryptoCWTClaims-SetBUN-JBundleDigestBUN-CsubmodNested-TokenLegend:ProcessWireFmtCDDL
Figure 2:EAT Types

3.A Media Type Parameter for EAT Profiles

EAT is an open and flexible format. To improve interoperability,Section 6 of [EAT] defines the concept of EAT profiles. Profiles are used to constrainthe parameters that producers and consumers of a specific EAT profile need tounderstand in order to interoperate, e.g., the number and type ofclaims, which serialisation format, the supported signature schemes, etc. EATscarry an in-band profile identifier using the "eat_profile" claim (seeSection 4.3.2 of [EAT]). The value of the "eat_profile" claim is either anOID or a URI.

The media types defined in this document include an optional "eat_profile"parameter that can be used to mirror the "eat_profile" claim of the transportedEAT. Exposing the EAT profile at the API layer allows API routers to dispatchpayloads directly to the profile-specific processor without having to snoopinto the request bodies. This design also provides a finer-grained andscalable type system that matches the inherent extensibility of EAT. Theexpectation being that a certain EAT profile automatically obtains a media typederived from the base (e.g.,application/eat+cwt) by populating the"eat_profile" parameter with the corresponding OID or URL.

When the parameterised version of the EAT media type is used in HTTP (forexample, with the "Content-Type" and "Accept" headers) and the value is anabsolute URI (Section 4.3 of [URI]), theparameter-value (Appendix A of [HTTP]) uses thequoted-string encoding, for example:

application/eat+jwt; eat_profile="tag:evidence.example,2022"

Instead, when the EAT profile is an OID, thetoken encoding (i.e., without quotes) can be used. For example:

application/eat+cwt; eat_profile=2.999.1.

4.Examples

The example inFigure 3 illustrates the usage of EAT media types fortransporting attestation evidence as well as negotiating the acceptable formatof the attestation result.

NOTE: '\' line wrapping per RFC 8792POST /challenge-response/v1/session/1234567890 HTTP/1.1Host: verifier.exampleAccept: application/eat+cwt; eat_profile="tag:ar4si.example,2021"Content-Type: application/eat+cwt; \              eat_profile="tag:evidence.example,2022"[ CBOR-encoded EAT w/ eat_profile="tag:evidence.example,2022" ]
Figure 3:Example REST Verification API (request)

The example inFigure 4 illustrates the usage of EAT media types fortransporting attestation results.

NOTE: '\' line wrapping per RFC 8792HTTP/1.1 200 OKContent-Type: application/eat+cwt; \              eat_profile="tag:ar4si.example,2021"[ CBOR-encoded EAT w/ eat_profile="tag:ar4si.example,2021" ]
Figure 4:Example REST Verification API (response)

In both cases, a tag URI[TAG] identifying the profile is carried as anexplicit parameter.

5.Security Considerations

Media types only provide clues to the processing application. The applicationmust verify that the received data matches the expected format, regardless ofthe advertised media type, and stop further processing on failure. Failing todo so could expose the user to security risks, such as privilege escalationand cross-protocol attacks.

The security considerations of[EAT] and[UCCS] apply in full.

When usingapplication/eat-ucs+json andapplication/eat-ucs+cbor in particular, the reader should reviewSection 3 of [UCCS], which contains a detailed discussion about the characteristics of a "Secure Channel" for conveyance of such messages.

6.IANA Considerations

6.1.+cwt Structured Syntax Suffix

IANA has registered+cwt in the"Structured Syntax Suffixes" registry[STRUCT-SYNTAX] inthe manner described in[MEDIATYPES].+cwt can be used to indicate that themedia type is encoded as a CWT.

6.1.1.Registry Contents

Name:

CBOR Web Token (CWT)

+suffix:

+cwt

References:

[CWT]

Encoding Considerations:

binary

Interoperability Considerations:

N/A

Fragment Identifier Considerations:

The syntax and semantics of fragment identifiers specified for+cwt SHOULD beas specified forapplication/cwt. (At the time of publication, thereis no fragment identification syntax defined forapplication/cwt.)

Security Considerations:

SeeSection 8 of [CWT]

Contact:

RATS WG mailing list (rats@ietf.org), or IETF Security Area (saag@ietf.org)

Author/Change Controller:

Remote ATtestation ProcedureS (RATS) Working Group.The IETF has change control over this registration.

6.2.Media Types

IANA has registered the following media types in the"Media Types" registry[MEDIA-TYPES].

Table 1:New Media Types
NameTemplateReference
EAT CWTapplication/eat+cwtRFC 9782,Section 6.3
EAT JWTapplication/eat+jwtRFC 9782,Section 6.4
Detached EAT Bundle CBORapplication/eat-bun+cborRFC 9782,Section 6.5
Detached EAT Bundle JSONapplication/eat-bun+jsonRFC 9782,Section 6.6
EAT UCCSapplication/eat-ucs+cborRFC 9782,Section 6.7
EAT UJCSapplication/eat-ucs+jsonRFC 9782,Section 6.8

6.3.application/eat+cwt Registration

Type name:

application

Subtype name:

eat+cwt

Required parameters:

N/A

Optional parameters:

"eat_profile" (EAT profile in string format. OIDs must use thedotted-decimal notation. The parameter value is case insensitive.)

Encoding considerations:

binary

Security considerations:

Section 9 of [EAT]

Interoperability considerations:

N/A

Published specification:

RFC 9782

Applications that use this media type:

Attesters, Verifiers, Endorsers and Reference-Value providers, and RelyingParties that need to transfer EAT payloads over HTTP(S), CoAP(S), and othertransports.

Fragment identifier considerations:

N/A

Person & email address to contact for further information:

RATS WG mailing list (rats@ietf.org)

Intended usage:

COMMON

Restrictions on usage:

none

Author/Change controller:

IETF

Provisional registration:

no

6.4.application/eat+jwt Registration

Type name:

application

Subtype name:

eat+jwt

Required parameters:

N/A

Optional parameters:

"eat_profile" (EAT profile in string format. OIDs must use thedotted-decimal notation. The parameter value is case insensitive.)

Encoding considerations:

8bit

Security considerations:

Section 9 of [EAT] and[BCP225]

Interoperability considerations:

N/A

Published specification:

RFC 9782

Applications that use this media type:

Attesters, Verifiers, Endorsers and Reference-Value providers, and RelyingParties that need to transfer EAT payloads over HTTP(S), CoAP(S), and othertransports.

Fragment identifier considerations:

N/A

Person & email address to contact for further information:

RATS WG mailing list (rats@ietf.org)

Intended usage:

COMMON

Restrictions on usage:

none

Author/Change controller:

IETF

Provisional registration:

no

6.5.application/eat-bun+cbor Registration

Type name:

application

Subtype name:

eat-bun+cbor

Required parameters:

N/A

Optional parameters:

"eat_profile" (EAT profile in string format. OIDs must use thedotted-decimal notation. The parameter value is case insensitive.)

Encoding considerations:

binary

Security considerations:

Section 9 of [EAT]

Interoperability considerations:

N/A

Published specification:

RFC 9782

Applications that use this media type:

Attesters, Verifiers, Endorsers and Reference-Value providers, and RelyingParties that need to transfer EAT payloads over HTTP(S), CoAP(S), and othertransports.

Fragment identifier considerations:

N/A

Person & email address to contact for further information:

RATS WG mailing list (rats@ietf.org)

Intended usage:

COMMON

Restrictions on usage:

none

Author/Change controller:

IETF

Provisional registration:

no

6.6.application/eat-bun+json Registration

Type name:

application

Subtype name:

eat-bun+json

Required parameters:

N/A

Optional parameters:

"eat_profile" (EAT profile in string format. OIDs must use thedotted-decimal notation. The parameter value is case insensitive.)

Encoding considerations:

Same as[JSON]

Security considerations:

Section 9 of [EAT]

Interoperability considerations:

N/A

Published specification:

RFC 9782

Applications that use this media type:

Attesters, Verifiers, Endorsers and Reference-Value providers, and RelyingParties that need to transfer EAT payloads over HTTP(S), CoAP(S), and othertransports.

Fragment identifier considerations:

N/A

Person & email address to contact for further information:

RATS WG mailing list (rats@ietf.org)

Intended usage:

COMMON

Restrictions on usage:

none

Author/Change controller:

IETF

Provisional registration:

no

6.7.application/eat-ucs+cbor Registration

Type name:

application

Subtype name:

eat-ucs+cbor

Required parameters:

N/A

Optional parameters:

"eat_profile" (EAT profile in string format. OIDs must use thedotted-decimal notation. The parameter value is case insensitive.)

Encoding considerations:

binary

Security considerations:

Sections3 and7 of[UCCS]

Interoperability considerations:

N/A

Published specification:

RFC 9782

Applications that use this media type:

Attesters, Verifiers, Endorsers and Reference-Value providers, and RelyingParties that need to transfer EAT payloads over HTTP(S), CoAP(S), and othertransports.

Fragment identifier considerations:

N/A

Person & email address to contact for further information:

RATS WG mailing list (rats@ietf.org)

Intended usage:

COMMON

Restrictions on usage:

none

Author/Change controller:

IETF

Provisional registration:

no

6.8.application/eat-ucs+json Registration

Type name:

application

Subtype name:

eat-ucs+json

Required parameters:

N/A

Optional parameters:

"eat_profile" (EAT profile in string format. OIDs must use thedotted-decimal notation. The parameter value is case insensitive.)

Encoding considerations:

Same as[JSON]

Security considerations:

Sections3 and7 of[UCCS]

Interoperability considerations:

N/A

Published specification:

RFC 9782

Applications that use this media type:

Attesters, Verifiers, Endorsers and Reference-Value providers, and RelyingParties that need to transfer EAT payloads over HTTP(S), CoAP(S), and othertransports.

Fragment identifier considerations:

N/A

Person & email address to contact for further information:

RATS WG mailing list (rats@ietf.org)

Intended usage:

COMMON

Restrictions on usage:

none

Author/Change controller:

IETF

Provisional registration:

no

6.9.CoAP Content-Format Registrations

IANA has registered the following Content-Format numbers in the "CoAPContent-Formats" registry, within the "Constrained RESTful Environments(CoRE) Parameters" registry group[CORE-PARAMS]:

Table 2:New Content-Formats
Content TypeContent CodingIDReference
application/eat+cwt-263RFC 9782
application/eat+jwt-264RFC 9782
application/eat-bun+cbor-265RFC 9782
application/eat-bun+json-266RFC 9782
application/eat-ucs+cbor-267RFC 9781
application/eat-ucs+json-268RFC 9782

7.References

7.1.Normative References

[BCP225]
Best Current Practice 225,<https://www.rfc-editor.org/info/bcp225>.
At the time of writing, this BCP comprises the following:
Sheffer, Y.,Hardt, D., andM. Jones,"JSON Web Token Best Current Practices",BCP 225,RFC 8725,DOI 10.17487/RFC8725,,<https://www.rfc-editor.org/info/rfc8725>.
[CORE-PARAMS]
IANA,"CoAP Content-Formats",<https://www.iana.org/assignments/core-parameters>.
[CWT]
Jones, M.,Wahlstroem, E.,Erdtman, S., andH. Tschofenig,"CBOR Web Token (CWT)",RFC 8392,DOI 10.17487/RFC8392,,<https://www.rfc-editor.org/info/rfc8392>.
[EAT]
Lundblade, L.,Mandyam, G.,O'Donoghue, J., andC. Wallace,"The Entity Attestation Token (EAT)",RFC 9711,DOI 10.17487/RFC9711,,<https://www.rfc-editor.org/info/rfc9711>.
[HTTP]
Fielding, R., Ed.,Nottingham, M., Ed., andJ. Reschke, Ed.,"HTTP Semantics",STD 97,RFC 9110,DOI 10.17487/RFC9110,,<https://www.rfc-editor.org/info/rfc9110>.
[JSON]
Bray, T., Ed.,"The JavaScript Object Notation (JSON) Data Interchange Format",STD 90,RFC 8259,DOI 10.17487/RFC8259,,<https://www.rfc-editor.org/info/rfc8259>.
[MEDIA-TYPES]
IANA,"Media Types",<https://www.iana.org/assignments/media-types>.
[MEDIATYPES]
Freed, N.,Klensin, J., andT. Hansen,"Media Type Specifications and Registration Procedures",BCP 13,RFC 6838,DOI 10.17487/RFC6838,,<https://www.rfc-editor.org/info/rfc6838>.
[STRUCT-SYNTAX]
IANA,"Structured Syntax Suffixes",<https://www.iana.org/assignments/media-type-structured-suffix>.
[UCCS]
Birkholz, H.,O'Donoghue, J.,Cam-Winget, N., andC. Bormann,"A Concise Binary Object Representation (CBOR) Tag for Unprotected CBOR Web Token Claims Sets (UCCS)",RFC 9781,DOI 10.17487/RFC9781,,<https://www.rfc-editor.org/info/rfc9781>.
[URI]
Berners-Lee, T.,Fielding, R., andL. Masinter,"Uniform Resource Identifier (URI): Generic Syntax",STD 66,RFC 3986,DOI 10.17487/RFC3986,,<https://www.rfc-editor.org/info/rfc3986>.

7.2.Informative References

[BUILD-W-HTTP]
Best Current Practice 56,<https://www.rfc-editor.org/info/bcp56>.
At the time of writing, this BCP comprises the following:
Nottingham, M.,"Building Protocols with HTTP",BCP 56,RFC 9205,DOI 10.17487/RFC9205,,<https://www.rfc-editor.org/info/rfc9205>.
[RATS-ARCH]
Birkholz, H.,Thaler, D.,Richardson, M.,Smith, N., andW. Pan,"Remote ATtestation procedureS (RATS) Architecture",RFC 9334,DOI 10.17487/RFC9334,,<https://www.rfc-editor.org/info/rfc9334>.
[REST-IoT]
Keränen, A.,Kovatsch, M., andK. Hartke,"Guidance on RESTful Design for Internet of Things Systems",Work in Progress,Internet-Draft, draft-irtf-t2trg-rest-iot-16,,<https://datatracker.ietf.org/doc/html/draft-irtf-t2trg-rest-iot-16>.
[TAG]
Kindberg, T. andS. Hawke,"The 'tag' URI Scheme",RFC 4151,DOI 10.17487/RFC4151,,<https://www.rfc-editor.org/info/rfc4151>.

Acknowledgments

Thank youCarl Wallace,Carsten Bormann,Dave Thaler,Deb Cooley,Éric Vyncke,Francesca Palombini,Jouni Korhonen,Kathleen Moriarty,Michael Richardson,Murray Kucherawy,Orie Steele,Paul Howard,Roman Danyliw, andTim Hollebeek for your comments and suggestions.

Authors' Addresses

Laurence Lundblade
Security Theory LLC
Email:lgl@securitytheory.com
Henk Birkholz
Fraunhofer Institute for Secure Information Technology
Rheinstrasse 75
64295Darmstadt
Germany
Email:henk.birkholz@ietf.contact
Thomas Fossati
Linaro
Email:thomas.fossati@linaro.org
[8]ページ先頭
©2009-2025 Movatter.jp