AI 中文总结
本文发现Project Veraison的TPM参考方案存在挑战随机数新鲜度缺口，通过端到端测试验证修复方案，使重放Quote的评估结果变为否定，提升了RATS架构的安全性。
AI 中文摘要
当自动智能体（例如AI智能体）执行重要操作时，其留下的记录由完整性存疑的软件栈生成。签名日志仅证明是哪个密钥生成了该记录，而非运行时的状态。此前研究提出将该记录（行动证据包，AEP：包含行动、授权主体及其结果的签名追加式记录）作为IETF远程证明过程（RATS）架构（RFC 9334）下的应用层证据，将结果绑定到硬件根TPM Quote中，若交换该结果则Quote失效。但此前工作仅针对最小验证器替身评估结果，本文填补了该缺口。我们通过符合规范的Project Veraison RATS验证器，将在仿真软件TPM上生成的AEP Quote端到端运行：生成EC P-256证明密钥，将AEP结果摘要测量到PCR中，将真实Quote打包为Veraison的tpm-enacttrust格式，配置简洁参考完整性清单（信任锚加黄金参考值），并获取签名的EAT证明结果（EAR）。良好证据会产生肯定结果，结果交换或一字节签名篡改会产生否定结果。过程中我们负责任地披露并修复了一项安全相关发现：参考方案未强制挑战随机数新鲜度，导致重放的Quote仍会被评估为肯定。我们提供了可上游化的两部分精确修复方案并完成端到端验证：修复生效后，同一有效Quote在自身会话中为肯定，重放到新会话时则变为否定。该流程完全可复现，证明方仍为仿真swtpm，不具备硬件保证。
英文摘要
When an automated agent (an AI agent, say) takes a consequential action, the record it leaves behind is produced by the very software stack whose integrity is in question. A signed log proves which key wrote the record, not what the runtime was. Prior work proposed treating that record (an Action Evidence Package, AEP: a signed append-only record of an action, its authorising principal, and its outcome) as application-layer Evidence under the IETF Remote ATtestation procedureS (RATS) architecture (RFC 9334), binding the outcome into a hardware-rooted TPM quote so that swapping it invalidates the quote. But that prior work appraised the result only against a minimal Verifier stand-in. This article closes that gap. We drive an AEP quote, produced on an emulated software TPM, end-to-end through a conformant Project Veraison RATS Verifier. We generate an EC P-256 attestation key, measure the AEP outcome digest into a PCR, pack a genuine quote into Veraison's tpm-enacttrust format, provision a Concise Reference Integrity Manifest (trust anchor plus golden reference value), and obtain a signed EAT Attestation Result (EAR). Good evidence yields affirming; an outcome-swap or a one-byte signature tamper yields contraindicated. Along the way we uncover, responsibly disclose, and fix a security-relevant finding: the reference scheme does not enforce challenge-nonce freshness, so a replayed quote still appraises as affirming. We give an exact, upstreamable two-part fix and validate it end-to-end. With the fix active, the same valid quote that is affirming in its own session flips to contraindicated when replayed to a fresh one. The pipeline is fully reproducible; the Attester remains an emulated swtpm, not a hardware guarantee.
Comments18 pages, 3 figures. Responsible disclosure: veraison/services#427, fixed in PR #432. Artifact and data: doi:10.5281/zenodo.20998730
