more fully delineate "privacy ca", "attestation ca", "anonymization ca"

[equalsJeffH]

the "privacy ca", "attestation ca", "anonymization ca" terms appear in the spec in various places and the Note in 14.4.1. Attestation Privacy attempts to tease them apart, but could do a better job. Am imagining appending a bulleted list summarizing each's particular characteristics, or re-writing the Note to more clearly delineate between them.

[equalsJeffH]

this is a very minor nice-to-have issue, can be addressed in a milestone later than wd-03 or not at all.

[equalsJeffH]

this may end up intertwining to some degree with issue #1453.

[alanwaketan]

I'm proposing a change to the AttCA to the following:

Anonymous CA
In this case, the Authenticator works with a cloud-operated Anonymous CA owned by its manufacturer to dynamically generate per-credential attestation certificates on the CA such that no identification information of the authenticator will be revealed to RPs in the attestation statement.

The above is basing on the original description of Privacy CA and the writing from 14.4.1. Attestation Privacy. It's trying to keep the concept simple to only reflect the common facts. How the authenticator is communicated with the CA is intentionally omitted given it is very vendor specific. Comments are welcomed!

[nadalin]

@alanwaketan to create PR

[alanwaketan]

Do we know if there is any other shipping products of Anonymous CA, especially any TPM products?