6

The universal map: the RATS model

goal: the vendor-neutral language that unifies all of Phase 5
objective Rise above any single vendor to the shared standard so you can reason about — or design — any attestation system. RATS = Remote ATtestation procedureS, the internet standard (published 2023) that names the roles.
Attesterthe machine proving itself (your enclave) Verifierjudges the evidenceagainst known-good Relying Partyacts on the verdict(grants access) Endorsermaker vouches "genuine chip" Reference Value Providersupplies the known-good fingerprints evidence result Two flow patterns to recognize "Passport": the machine gets a verdict, then shows it around (like a passport) "Background-check": the gate sends the evidence off to be judged (like a job reference)
Five roles, one sentence each. Amazon's key-release from Phase 5 is a "background-check": the Key Service (Relying Party) leans on Amazon (Verifier) to judge your enclave (Attester). Learn to drop any system onto these five boxes.

The supporting cast (spoken-language)

Passport Attester Verifier Relying Party evidence result shows the result it already holds Background-check Attester Relying Party Verifier evidence evidence result same roles either way — what changes is who carries the evidence to the Verifier
Two flows, the same five roles. In the passport pattern the machine is judged once and then shows the result around; in the background-check pattern the gate takes the evidence and has it judged. Amazon's key release is a background-check — the Key Service leans on Amazon to judge your enclave.
  • EAT (Entity Attestation Token, now a finished standard, 2025) = a standard little envelope of attestation facts (fingerprints, freshness, device identity).
  • CoRIM (Concise Reference Integrity Manifest) = a standard file of "known-good fingerprints" to hand a Verifier. Still a draft, not final — say so.
  • DICE (Device Identifier Composition Engine) = measured boot without a chip, for tiny devices: each layer derives the next layer's key from a secret + the next layer's fingerprint (diagram below).
  • Keylime = open-source tool for continuous attestation of a whole fleet, not just a one-time check.
  • SLSA (Supply-chain Levels for Software Artifacts) = a framework for trustworthy build records — the bridge that makes a predicted PCR0 believable.
device secretbaked in at factory + fingerprint layer 1 key + fingerprint layer 2 key …any codechange breaksevery later key
DICE generalizes the whole idea to devices too small for a chip: change any layer's code and all downstream keys change — the same tamper-evidence, done with key derivation instead of registers.
lab 6 · model & verify

Take three systems from Phase 5 (Nitro, an AMD confidential VM, a plain chip report) and draw each as the five RATS boxes — labeling the roles and which flow pattern it uses. Then stand up the open-source Veraison verifier and feed it known-good values.

mastery gate 6

Given any attestation system, sort it into the five roles and name its flow pattern within a minute. Explain the difference between an Endorsement ("this is genuine hardware") and a Reference Value ("this is the expected fingerprint") — and why confusing them is a security bug.

sources
RFC 9334 RATS Architecture — link · RFC 9711 Entity Attestation Token — link · CoRIM draft — link · TCG DICE — link · Keylime — link · Veraison — link