Abstract

The payloads used in Remote ATtestation procedureS (RATS) may require an associated media type for their conveyance, for example, when the payloads are used in RESTful APIs.¶

This memo defines media types to be used for Entity Attestation Tokens (EATs).¶

Status of This Memo

This is an Internet Standards Track document.¶

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841.¶

Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at https://www.rfc-editor.org/info/rfc9782.¶

Copyright Notice

Copyright (c) 2025 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

Payloads used in Remote ATtestation procedureS (RATS) [RATS-ARCH] may require an associated media type for their conveyance, for example, when used in RESTful APIs (Figure 1).¶

This memo defines media types to be used for EAT payloads [EAT] independently of the RATS Conceptual Message in which they manifest themselves. The objective is to give protocol, API, and application designers a number of readily available and reusable media types for integrating EAT-based messages in their flows, e.g., when using HTTP [BUILD-W-HTTP] or the Constrained Application Protocol (CoAP) [REST-IoT].¶

2. EAT Types

Figure 2 illustrates the six EAT wire formats and how they relate to each other. [EAT] defines four of them (CBOR Web Token (CWT), JSON Web Token (JWT), and the detached EAT bundle in its JSON and CBOR flavours), while [UCCS] defines the Unprotected CWT Claims Set (UCCS) and Unprotected JWT Claims Sets (UJCS).¶

4. Examples

The example in Figure 3 illustrates the usage of EAT media types for transporting attestation evidence as well as negotiating the acceptable format of the attestation result.¶

NOTE: '\' line wrapping per RFC 8792

POST /challenge-response/v1/session/1234567890 HTTP/1.1
Host: verifier.example
Accept: application/eat+cwt; eat_profile="tag:ar4si.example,2021"
Content-Type: application/eat+cwt; \
              eat_profile="tag:evidence.example,2022"

[ CBOR-encoded EAT w/ eat_profile="tag:evidence.example,2022" ]

The example in Figure 4 illustrates the usage of EAT media types for transporting attestation results.¶

NOTE: '\' line wrapping per RFC 8792

HTTP/1.1 200 OK
Content-Type: application/eat+cwt; \
              eat_profile="tag:ar4si.example,2021"

[ CBOR-encoded EAT w/ eat_profile="tag:ar4si.example,2021" ]

In both cases, a tag URI [TAG] identifying the profile is carried as an explicit parameter.¶

5. Security Considerations

Media types only provide clues to the processing application. The application must verify that the received data matches the expected format, regardless of the advertised media type, and stop further processing on failure. Failing to do so could expose the user to security risks, such as privilege escalation and cross-protocol attacks.¶

The security considerations of [EAT] and [UCCS] apply in full.¶

When using application/eat-ucs+json and application/eat-ucs+cbor in particular, the reader should review Section 3 of [UCCS], which contains a detailed discussion about the characteristics of a "Secure Channel" for conveyance of such messages.¶

6. IANA Considerations

7. References

Acknowledgments

Thank you Carl Wallace, Carsten Bormann, Dave Thaler, Deb Cooley, Éric Vyncke, Francesca Palombini, Jouni Korhonen, Kathleen Moriarty, Michael Richardson, Murray Kucherawy, Orie Steele, Paul Howard, Roman Danyliw, and Tim Hollebeek for your comments and suggestions.¶

Authors' Addresses