Re: [Rats] use case document updates on Roots of Trust

Laurence Lundblade <lgl@island-resort.com> Sun, 15 September 2019 20:50 UTC

Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
From: Laurence Lundblade <lgl@island-resort.com>
In-Reply-To: <92137679-7DEA-42AD-B8D1-F3B909C77459@akamai.com>
Date: Sun, 15 Sep 2019 13:50:15 -0700
Cc: Michael Richardson <mcr+ietf@sandelman.ca>, "rats@ietf.org" <rats@ietf.org>
Content-Transfer-Encoding: quoted-printable
Message-Id: <BAA4C3C3-C98B-4BA7-8C89-A169DD99EF86@island-resort.com>
References: <4155.1567948986@dooku.sandelman.ca> <64BD12AA-951A-468A-9F08-D442054605AD@island-resort.com> <de6ff852-062d-805d-3eed-10aca60502b2@sit.fraunhofer.de> <CAN40gStH5jUCJeVggREr3ABoFw7K97F=KtoJOSR_X+LWNLB+JA@mail.gmail.com> <CAN40gSu13DKkyahHA3_Cbt5j7Gsh=uGh5ic7fS3AvDGP3K1cug@mail.gmail.com> <5276.1568315351@dooku.sandelman.ca> <92137679-7DEA-42AD-B8D1-F3B909C77459@akamai.com>
To: "Salz, Rich" <rsalz@akamai.com>
Archived-At: <https://mailarchive.ietf.org/arch/msg/rats/1nC-solzw_BrVgFNR6P6tsqdK90>
Subject: Re: [Rats] use case document updates on Roots of Trust
Precedence: list

On Sep 12, 2019, at 3:31 PM, Salz, Rich <rsalz@akamai.com> wrote:
> 
> I do not see a meaningful difference between "trust anchor" and "trust root" and "root(s) of trust."  All of them:
> 	- Are pieces of data (certificate or key is not meaningful)
> 	- Used to verify something such as a certificate or signature
> 	- Are trusted by the application, based on actions that are "out of band" of the application itself

This is not how I understand a root of trust, nor how I think it is generally used in the TCG or TEE worlds. I think a root of trust involves a CPU, memory and SW that actively does something like boot and measure a device. There is usually a boundary around it so that other software on the device, like the high-level OS, can’t corrupt it. When it is doing reporting as in RATS it will have a private key that can do some signing. When it is doing trusted/secure boot, it will also have a public key to verify the software it loads.

LL

[Rats] use case document updates on Roots of Trust Michael Richardson
Re: [Rats] use case document updates on Roots of … Laurence Lundblade
Re: [Rats] use case document updates on Roots of … Henk Birkholz
Re: [Rats] use case document updates on Roots of … Ira McDonald
Re: [Rats] use case document updates on Roots of … Ira McDonald
Re: [Rats] use case document updates on Roots of … Smith, Ned
Re: [Rats] use case document updates on Roots of … Ira McDonald
Re: [Rats] use case document updates on Roots of … Henk Birkholz
Re: [Rats] use case document updates on Roots of … Smith, Ned
Re: [Rats] use case document updates on Roots of … Henk Birkholz
Re: [Rats] use case document updates on Roots of … Michael Richardson
Re: [Rats] use case document updates on Roots of … Salz, Rich
Re: [Rats] use case document updates on Roots of … Carl Wallace
Re: [Rats] use case document updates on Roots of … Henk Birkholz
Re: [Rats] use case document updates on Roots of … Laurence Lundblade
Re: [Rats] use case document updates on Roots of … Jeremy O'Donoghue
Re: [Rats] use case document updates on Roots of … Salz, Rich
Re: [Rats] use case document updates on Roots of … Carl Wallace
Re: [Rats] use case document updates on Roots of … Michael Richardson
Re: [Rats] use case document updates on Roots of … Michael Richardson
Re: [Rats] use case document updates on Roots of … Michael Richardson
[Rats] 答复: use case document updates on Roots of … Xialiang (Frank, Network Standard & Patent Dept)
Re: [Rats] 答复: use case document updates on Roots… Carl Wallace
[Rats] 答复: 答复: use case document updates on Roots… Xialiang (Frank, Network Standard & Patent Dept)