Re: [Rats] FIDO TPM attestation

[Henk Birkholz <[e-mail]>]

There should be "hints" (this a common and often used concept) that 
provide qualification to Attestation Evidence with respect to its 
intended protection. Policies should be able to decide how and why to 
rely on these protection hints, I think.

Hints could be implied by signature semantics, though. If not they 
should be made explicit.

Viele Grüße,

Henk


On 16.11.19 01:58, Smith, Ned wrote:
[..]
> In either case, it doesn’t make sense for RATS WG (outside of gaining 
> technical context) to rationalize which technology is more/less secure. 
> This is a policy decision applied by Verifiers and Relying Parties. RATS 
> WG should think about what claims should be expressed and how best to 
> instantiate them IMHO.
> 
> -Ned
> 
> *From: *RATS <[e-mail]> on behalf of Laurence Lundblade 
> <[e-mail]>
> *Date: *Friday, November 15, 2019 at 10:41 AM
> *To: *"Fuchs, Andreas" <[e-mail]>
> *Cc: *"[e-mail]" <[e-mail]>
> *Subject: *Re: [Rats] FIDO TPM attestation
> 
> Hi Andreas,
> 
> Here’s the frame up as I see it for EAT  and FIDO from most secure to 
> least. I believe EAT implementations can eventually be as secure as a 
> TPM and we want to design EAT so such high-security implementations will 
> eventually be in the market.
> 
> *Hardware-Only (No SW!)*
> 
> ·EAT with a small number of claims (HW Version, HW OEM, boot / debug 
> state, simple TPM-like measurement) is possible in pure HW.
> 
> ·Pretty sure many TPMs are implemented in pure HW.
> 
> ·Certifiable to very high levels.
> 
> ·FIDO is too complex for pure HW.
> 
> *Secure Element and similar*
> 
> ·EAT with a lot of claims
> 
> ·Simpler FIDO implementations without biometrics.
> 
> ·Some may consider this less secure than pure HW because complexity is 
> higher, but I don’t think there is an absolute rule here.
> 
> ·Pretty sure this can be CC certified at the same level as HW only.
> 
> *Separate CPU*
> 
> You can add a CPU like an Arm Cortex M3 to your circuit board or to your 
> SoC. Some of off-the-shelf CPUs even have some HW defenses (the SC 
> version of the M3). It can run some super simple SW, simpler than a 
> secure element.
> 
> ·EAT with a lot of claims
> 
> ·Most all FIDO
> 
> ·I’d peg security and certifiability as somewhere between the secure 
> element and the TEE depending on the HW design. Both can be pretty high.
> 
> *TEE, SGX, VBS*
> 
> ·EAT with a lot of claims
> 
> ·Most all FIDO
> 
> ·Usually cannot implement advanced HW chip defenses because these are a 
> mode of super-fast large CPUs and these defense would slow them down to 
> much and consume too much power.
> 
> ·Not certifiable at the same levels as the above, but still certifiable 
> in pretty thorough ways like the CC-based GP TEE PP (link below)
> 
> ·SW complexity is a lot higher so either certification cost is higher or 
> certification is less thorough
> 
> Don’t disagree with anything in your latest comment. :-)
> 
> LL
> 
> 
> 
>     On Nov 14, 2019, at 8:17 AM, Fuchs, Andreas
>     <[e-mail]
>     <mailto:[e-mail]>> wrote:
> 
>     We were talking about FIDO as one of many applications running in a TEE.
> 
>     They rely on correctness of other TEE-apps and/or the TEE kernel
> 
>     (or should I rather say TEE operating system). Thus a turing
>     complete solution
> 
>     (maybe even with loadable apps) and OS cannot be as secure as a
>     special-purpose
> 
>     functional logic security provider.
> 
>     Also, by design an on-chip TEE offering cannot be as secure as a
>     physically
> 
>     separated chip that incorporates smartcard technologies. You also
>     highlight
> 
>     this by providing yubikey as example which is both; a separate
>     SC-like chip
> 
>     and fixed functional logic (similar to TPMs).
> 
>     To conclude: fixed functional logic and separate chips have higher
>     assurance
> 
>     levels than turing-complete (loadable) areas of the main cpu.
> 
>     And to your original point: TPMs are the preferred solution for
>     attestation
> 
>     in contrast to to a TEE-based approach, just as YubiKeys et al are
>     preferred
> 
>     for FIDO in contrast to a TEE-based approach.
> 
>     ------------------------------------------------------------------------
> 
>     *From:*Laurence Lundblade [[e-mail]
>     <mailto:[e-mail]>]
>     *Sent:*Thursday, November 14, 2019 16:51
>     *To:*Fuchs, Andreas
>     *Cc:*[e-mail] <mailto:[e-mail]>
>     *Subject:*Re: [Rats] FIDO TPM attestation
> 
>         On Nov 14, 2019, at 1:46 AM, Fuchs, Andreas
>         <[e-mail]
>         <mailto:[e-mail]>> wrote:
> 
>         The FIDO code running inside a TEE is not standardized (to the
>         level of TPM) and most certainly not CC-evaluated.
> 
>     That’s not true.
> 
>         TheFIDO L3 and L3+ Certification program
>         <https://fidoalliance.org/certification/authenticator-certification-levels/authenticator-level-3/> is
>         CC (Common Criteria) based (AVA_VAN.3 and AVA_VAN.4).
> 
>         Many FIDO authenticators run on secure elements which provides
>         roughly equivalent security to a TPM, however since the full
>         authenticator protocol runs on the turing-complete secure
>         element the full FIDO protocol is secured, not just the key
>         storage. Here’s one
>         <https://www.yubico.com/products/yubikey-hardware/yubikey%20neo/>.
> 
>         Global Platform offers a CC-based certification program for
>         TEE’s
>         <https://www.commoncriteriaportal.org/files/ppfiles/anssi-profil_PP-2014_01.pdf>.
>         FIDO is working on a certification program that will make use of
>         that.
> 
>         BSI has published a CC-based protection profile for FIDO
>         <https://www.commoncriteriaportal.org/files/ppfiles/pp0096a_pdf.pdf>.
> 
>         Android Keystore’s now supports StrongBox
>         <https://proandroiddev.com/android-keystore-what-is-the-difference-between-strongbox-and-hardware-backed-keys-4c276ea78fd0>,
>         which puts the keys in a secure element.
> 
>         Qualcomm’s Snapdragon mobile phone chip has a secure-element
>         like subsystem
>         <https://www.qualcomm.com/news/releases/2019/06/25/qualcomm-snapdragon-855-becomes-first-mobile-soc-receive-smart-card> (not
>         the TEE) that is CC-certified.
> 
>         TEE and TEE-like offerings are stronger than they used to be,
>         particular by supporting memory encryption.
> 
>     Turing complete security products come in a range of security levels
>     all the way up the security level offered by a TPM. EAT
>     implementations can be just as secure and certified as TPM attestation.
> 
>     LL
> 
> 
> 
> 
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats
>