Re: [Coin] Interim in 12 minutes

[Pascal Urien <[e-mail]>]

Dear chair

I would like to present the IOSE project at the next WG meeting. It is an
open research project that aims to deploy secure and trusted computing
resources on the Internet. The source codes of the project are available on
github.

A short presentation is available at
https://datatracker.ietf.org/meeting/114/materials/slides-114-hotrfc-sessa-internet-of-secure-elements-pascal-urien-00.pdf

Here is a short summary
===================.
The goal of the Internet Secure Elements (IOSE) project [1] [2] is to
deploy trusted cryptographic resources identified by Uniform Resource
Identifiers (URI) for Internet users
The problems to be solved are to guarantee to the user the authenticity of
the remote resource used, its level of security, and its exclusive access.
Other aspects are scalability and costs.
The IOSE technology is based on secure elements; 10 billion of secure
elements are produced each year, of which 6 billion are javacards for which
programs can be written in java.
The project uses two plans, first for administration and second for service.
Administration plane consists of listing, removing and uploading
applications in secure elements. Most secure elements use Global Platform
protocols (over ISO7816) to perform these operations.
- Remote APDU Call Secure (RACS) [3], transports GP protocols, over TLS
sessions
- End entities are mutually authenticated by X509 certificates
- In this context secure elements are identified by Secure Element
Identifier (SEID), inserted in RACS messages
The service plane relies on TLS 1.3 interface, named TLS-SE (TLS for Secure
Element)[4]
- Secure Elements run TLS1.3 server, using pre-shared-key (PSK), and a
server name (SEN).
- The server name is found in the historical bytes (up to 15 bytes) of the
secure element Answer To Reset (ATR).
- TLS packets are transported over ISO7816 interface
- The client-facing server finds in the ClientHello Server Name Indication
(SNI) the secure element name (SEN). Thereafter it performs
segmentation/reassembly operations in order to transport TLS packet over
the communication interface.
- Optional TLS Identity Module (TLS-IM) [5] computes PSK procedures
- Secure element is the backend server, identified by a server name
The attestation procedure transfers secure element control from application
provider to user. Its security relies on two properties:
 -1) secure element cannot be cloned;
-2) and it manages only one TLS session at a given time.

IOSE server open code (windows, linux) and javacard code for TLS_SE and
TLS-IM are available at github [2]

[1] https://datatracker.ietf.org/doc/draft-urien-coinrg-iose
[2] https://github.com/purien/IoSE
[3] https://datatracker.ietf.org/doc/draft-urien-core-racs
[4] https://datatracker.ietf.org/doc/draft-urien-tls-se
[5] https://datatracker.ietf.org/doc/draft-urien-tls-im

Best Regards
Pascal