Re: [EAT] [Rats] Real EAT implementations

[Hannes Tschofenig <[e-mail]>]

Hi Michael,

Arm has launched the Platform Security Architecture (PSA) at Arm TechCon 2017 with the goal to improve IoT security.
It is a fairly broad effort clustered into three areas, namely an analysis, architecture and implementation phase. For the first phase we provide templates for threat analysis to derive security requirements. For the architecture phase we offer hardware specifications. For the third phase we offer code.

The Linaro foundation has started a project for firmware development on these Cortex M-class devices (called Trusted Firmware M, or TF-M), see https://community.arm.com/iot/b/blog/posts/the-next-step-for-psa-and-a-secure-iot-future. The TF-M is the place where we are implement the EAT token functionality (as part of the attestation API). There are also other APIs, such as crypto and secure storage.
Since the attestation API not only allows an application to access attestation functionality locally on the device but also to expose these attestation tokens to other services there is an interoperability problem. The Qualcomm-developed token format, which re-uses existing IETF technology, showed up at the right time for us and we believe it is a good approach. For this reason we support draft-ietf-mandyam-eat.

The TF-M implementation and the work we do on attestation feels pretty real to me. We hope that many companies implementing IoT products want to make use of the TF-M code as a foundation to make their devices more secure.

Ciao
Hannes

PS: More details about the PSA can be found at https://pages.arm.com/psa-resources.html. If you happen to be in San Jose in the week of 16th - 18th October Arm and its partners will talk about the recent developments around the PSA (and IoT security in general) at Arm TechCon.

-----Original Message-----
From: EAT <[e-mail]> On Behalf Of Michael Richardson
Sent: Saturday, October 6, 2018 7:31 PM
To: [e-mail]; [e-mail]
Subject: Re: [EAT] [Rats] Real EAT implementations


Laurence Lundblade <[e-mail]> wrote:
    > I believe one of the area directors asked who’s going to implement
    > these attestation schemes we standardize. One answer is Qualcomm’s
    > already commercialized precursor implementation of EAT which is
    > described very briefly in official marketing material on Qualcomm’s
    > web site as “Hardware Token”.

I see this as evidence:
  1) the market doesn't need/want a standard
  2) Qualcomm isn't going to implement our standard, they already have their own.

Now that could be trivially be refuted if we saw clear participation from qualcomm, but I haven't seen it yet.  But, maybe I missed it.

I await the charter.
So far I haven't seen something that is concrete enough to be useful on its own.

--
Michael Richardson <[e-mail]>, Sandelman Software Works  -= IPv6 IoT consulting =-



IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.