Re: [EAT] Introduction

Proof of protection is a good description of what Keystore attestation aims
to accomplish, and timeliness or "freshness" is important.  Keystore
achieves the latter with a challenge value supplied by the verifier.

On Thu, Sep 6, 2018 at 6:21 PM Smith, Ned <ned.smith@intel.com> wrote:

> |--- snip ---
>
> |So Keystore provides a valuable tool to authors of apps that require
> strong
>
> |security. For example, for a key used to authenticate an account holder to
>
> |a banking system. But this tool is much less valuable if the bank's server
>
> |can't verify that the secret is managed in a trusted environment. Hence,
>
> |Keystore attestation, which allows the trusted environment to prove that
> it
>
> |secures the key material, and specifies the authorizations that define how
>
> |it may be used.
>
> --- snip ---
>
> Right, the main objective of attestation is to provide evidence to a
> verifier regarding the trustworthiness properties of the environment that
> protects keys and other important things. It goes beyond traditional
> proof-of-possession. I think of it as proof-of-protection (PoPr) though
> that term isn’t widely used. Distinguishing between storage and use may be
> important since protection techniques differ for each. At the
> end-of-the-day, attestation expects there is a ‘verifier’ – some entity
> that wants to check attestation evidence – who engages with the ‘attester’
> following some sort of protocol to pass attestation evidence. Timeliness of
> evidence exchange can be important since, often, environments that protect
> key storage and use will change during deployment (after initial
> manufacturing). Attestation protocol is needed to facilitate a timely
> exchange of attestation evidence. I think these aspects are a primary area
> where IETF could add value to attestation infrastructure.
> _______________________________________________
> EAT mailing list
> EAT@ietf.org
> https://www.ietf.org/mailman/listinfo/eat
>
-- 
Shawn Willden | Staff Software Engineer | swillden@google.com | 801-477-4296