Re: [Rats] More use cases for draft-richardson-rats-usecases-00

[Anders Rundgren <[e-mail]>]

On 2019-06-14 20:15, Michael Richardson wrote:
> 
> Anders Rundgren <[e-mail]> wrote:
>      >> Makes sense to me to capture current artifacts. Maybe in an appendix
>      >> to the use cases draft.
> 
>      > For completeness you should consider mentioning that there are two
>      > quite different platform attestation concepts: - Static: FIDO, Android,
>      > and current TEEP architecture - Session based: Used by some smart card
>      > schemes and SKS/KeyGen2
>      > (https://github.com/ietf-teep/architecture/issues/52)
> 
> I have added the following text.
> I read through the link above, and I found it really interesting, but I
> wasn't really sure if I could pin down some clear details about
> session attestions.

Hi Michael,

A session based attestation is the combination of a static attestation
and the creation of a shared session key.  That is, possible subsequent
operations using the shared session key "inherit" the initial attestation.
Such operations use MAC signatures and symmetric encryption (using keys
derived from the session key) in order to form a protected API.
Ideally a session based attestation scheme also provides "atomic"
operation, terminated by a "commit" call.

> 
> Are there things that could never be in one category or another?

To me they appear pretty distinct, including the code.

Regards,
Anders

> 
> ----
> 
> Platform attestions generally come in two categories. This document will
> attempt to indicate for a particular attestion technology falls into this.
> 
> ## Static attestions
> 
> A static attestion says something about the platform on which the code is
> running.
> 
> ## Session attestions
> 
> A session attestion says something about how the shared session key was
> created.

See text above.

> 
> --
> Michael Richardson <[e-mail]>, Sandelman Software Works
>   -= IPv6 IoT consulting =-
> 
> 
>