SPDM vs EAT domain separation analysis

[bluegate010]

EATS are CWTs which are signed via COSE. We should ensure that there is no way for a COSE signature to be misinterpreted as an SPDM signature, and vice versa.

This analysis will be useful collateral in a guidance doc stating that SPDM secure session transcripts should be signed by the same key that signs EATs.

[bluegate010]

Discussion June 2:

• Patterns
  • EAT sent over secure session
  • EAT has SPDM-native signature
  • EAT signed by same key as SPDM
  • In all cases: verifier checks SPDM secure session cert chain
• Anti-patterns
  • EAT not sent over secure session, EAT cert chain checked but not SPDM session cert chain