3.1. Two Types of Environments of an Attester
3.1. Two Types of Environments of an Attester
As shown in Figure 2, an Attester consists of at least one Attesting Environment and at least one Target Environment co-located in one entity. In some implementations, the Attesting and Target Environments might be combined into one environment. Other implementations might have multiple Attesting and Target Environments, such as in the examples described in more detail in Sections 3.2 and 3.3. Other examples may exist. All compositions of Attesting and Target Environments discussed in this architecture can be combined into more complex implementations.
.--------------------------------.
| |
| Verifier |
| |
'--------------------------------'
^
|
.-------------------------|----------.
| | |
| .----------------. | |
| | Target | | |
| | Environment | | |
| | | | Evidence |
| '--------------+-' | |
| | | |
| | | |
| Collect | | |
| Claims | | |
| | | |
| v | |
| .-------+-----. |
| | Attesting | |
| | Environment | |
| | | |
| '-------------' |
| Attester |
'------------------------------------'
Figure 2: Two Types of Environments within an Attester
Claims are collected from Target Environments. That is, Attesting Environments collect the values and the information to be represented in Claims by reading system registers and variables, calling into subsystems, and taking measurements on code, memory, or other relevant assets of the Target Environment. Attesting Environments then format the Claims appropriately; typically, they use key material and cryptographic functions, such as signing or cipher algorithms, to generate Evidence. There is no limit or requirement on the types of hardware or software environments that can be used to implement an Attesting Environment. For example, TEEs, embedded Secure Elements (eSEs), TPMs [TCGarch], or BIOS firmware.
An arbitrary execution environment may not, by default, be capable of Claims collection for a given Target Environment. Execution environments that are designed specifically to be capable of Claims collection are referred to in this document as "Attesting Environments". For example, a TPM doesn't actively collect Claims itself. Instead, it requires another component to feed various values to the TPM. Thus, an Attesting Environment in such a case would be the combination of the TPM together with whatever component is feeding it the measurements.