A Challenge-Nonce Freshness Gap in Project Veraison's TPM Reference Schemes, Found by Appraising Application-Layer Action Evidence End-to-End

Abstract

When an automated agent (an AI agent, say) takes a consequential action, the record it leaves behind is produced by the very software stack whose integrity is in question. A signed log proves which key wrote the record, not what the runtime was. Prior work proposed treating that record (an Action Evidence Package, AEP: a signed append-only record of an action, its authorising principal, and its outcome) as application-layer Evidence under the IETF Remote ATtestation procedureS (RATS) architecture (RFC 9334), binding the outcome into a hardware-rooted TPM quote so that swapping it invalidates the quote. But that prior work appraised the result only against a minimal Verifier stand-in. This article closes that gap. We drive an AEP quote, produced on an emulated software TPM, end-to-end through a conformant Project Veraison RATS Verifier. We generate an EC P-256 attestation key, measure the AEP outcome digest into a PCR, pack a genuine quote into Veraison's tpm-enacttrust format, provision a Concise Reference Integrity Manifest (trust anchor plus golden reference value), and obtain a signed EAT Attestation Result (EAR). Good evidence yields affirming; an outcome-swap or a one-byte signature tamper yields contraindicated. Along the way we uncover, responsibly disclose, and fix a security-relevant finding: the reference scheme does not enforce challenge-nonce freshness, so a replayed quote still appraises as affirming. We give an exact, upstreamable two-part fix and validate it end-to-end. With the fix active, the same valid quote that is affirming in its own session flips to contraindicated when replayed to a fresh one. The pipeline is fully reproducible; the Attester remains an emulated swtpm, not a hardware guarantee.