Found 3 records.

Status: Reported (1)

RFC 9711, "The Entity Attestation Token (EAT)", April 2025

Errata ID: 8528
Status: Reported
Type: Technical
Publication Format(s) : TEXT, PDF, HTML
Reported By: Steven Bellock
Date Reported: 2025-08-09

Section Appendix A says:

/ eat_nonce /       10: h'48df7b172d70b5a18935d0460a73dd71',
/ eat_nonce /       10: h'e253cabedc9eec24ac4e25bcbeaf7765',
/ eat_nonce /       10: h'd79b964ddd5471c1393c8888',
/ eat_nonce /       10: h'99b67438dba40743266f70bf75feb1026d5134
                              97a229bfe8',
/ eat_nonce /         10: h'8b0b28782a23d3f6',
/ eat_nonce / 10: h'5e19fba4483c7896',
/ eat_nonce /       10: h'3515744961254b41a6cf9c02',

It should say:

/ Nonce /      10: h'48df7b172d70b5a18935d0460a73dd71',
/ Nonce /      10: h'e253cabedc9eec24ac4e25bcbeaf7765',
/ Nonce /      10: h'd79b964ddd5471c1393c8888',
/ Nonce /      10: h'99b67438dba40743266f70bf75feb1026d5134
                              97a229bfe8',
/ Nonce /         10: h'8b0b28782a23d3f6',
/ Nonce / 10: h'5e19fba4483c7896',
/ Nonce /      10: h'3515744961254b41a6cf9c02',

Notes:

For all the CWT examples in Appendix A, where the claim name is "eat_nonce" it should be changed to "Nonce", as "eat_nonce" is only for JWT.

Status: Rejected (2)

RFC 9711, "The Entity Attestation Token (EAT)", April 2025

Errata ID: 8401
Status: Rejected
Type: Technical
Publication Format(s) : TEXT, PDF, HTML
Reported By: Muhammad Usama Sardar
Date Reported: 2025-05-01
Rejected by: Deb Cooley
Date Rejected: 2025-06-27

Section 1 says:

For attestation, the keys are associated with
specific devices and are configured by device manufacturers. 

It should say:

The quoted text is inaccurate and just an opinion of the editors. 
It should preferably be removed from the RFC.

Notes:

In SGX, the keys are not configured by the manufacturer alone. The platform owner can provide a random value called OWNER_EPOCH.

See this for technical details: https://mailarchive.ietf.org/arch/msg/rats/4V2zZHhk5IuxwcUMNWpPBpnzpaM/
--VERIFIER NOTES--
Incorrectly specified errata. The corrected text is not actually correct.

Errata ID: 8404
Status: Rejected
Type: Technical
Publication Format(s) : TEXT, PDF, HTML
Reported By: Muhammad Usama Sardar
Date Reported: 2025-05-04
Rejected by: Deb Cooley
Date Rejected: 2025-06-27

Section 8.4 says:

The nonce claim is based on a value usually derived
   remotely (outside of the entity).

It should say:

See notes

Notes:

Attester-generated nonce does not provide any replay protection since the Attester can pre-generate an Evidence that might not reflect the actual system state, but a past one.

See the attack trace for Attester-generated nonce at:
https://mailarchive.ietf.org/arch/msg/rats/jcAv9FKbYSIVtUNQ8ggEHL8lrmM/

For replay protection, nonce should *always* be derived remotely (for example, by the Relying Party).
--VERIFIER NOTES--
Incorrectly formatted errata. The corrected text is not correct.

Report New Errata