Re: [Rats] Debugging remote attestation with a phone

[Michael Eckel <[e-mail]>]

Hello Gabriel,

sounds like a very interesting and useful project. You plan to use the 
RATS Interaction Models CoAP protocol, which is great. In CHARRA, we 
also use it, more or less. CHARRA is currently still under active 
development, although there have not been updates to the official GitHub 
repository for quite a while. But, expect (major) updates in the 
not-too-distant future. :-)

Having a bluetooth binding for CHARRA would be awesome. Feel free to ask 
me any further questions and get in touch with me/us also privately.

Thank you
Michael


Fraunhofer SIT
*Michael Eckel*
Cyber Security Researcher
📧 [e-mail] <mailto:[e-mail]>
🕿 [phone] <tel:[phone]>

Fraunhofer Institute for Secure Information Technology SIT
🏭 Cyber-physical Systems Security
🏠 Rheinstraße 75, 64295 Darmstadt, Germany
🌍 sit.fraunhofer.de <https://sit.fraunhofer.de/>

Member of ATHENE

On 01.02.22 14:17, Kerneis Gabriel wrote:
> Dear all,
>
>
> TL;DR: looking for feedback and advice implementing TPM remote attestation over bluetooth; offering to attempt independent implementation of relevant RFC drafts as a way to contribute to this WG's interests.
>
>
> I have followed this group for a couple months now, but didn't introduce myself before. I am a security researcher at ANSSI<http://ssi.gouv.fr>, the French cybersecurity agency, working on firmware (and related OS) security.
>
>
> Starting in a couple of weeks, we'll be hosting an intern for 6 months with the aim of implementing a phone application acting as a remote attestation server over Bluetooth. We envision it as a user-friendly, versatile tool to help debugging secure/measured boot issues as well as (potentially) a second-factor delivering secrets to the laptop. I wrote a blog post to summarise my understanding of the state-of-the-art, including how it relates to RATS (that I was just discovering at the time): TPM remote attestation over Bluetooth<https://gabriel.kerneis.info/2021/11/local_attestation/>. We consider implementing the CoAP protocol described in ?appendix A of RIM<https://datatracker.ietf.org/doc/html/draft-ietf-rats-reference-interaction-models#appendix-A>, but could go in other directions (eg. the attestation protocol used by safeboot.net<http://safeboot.net>).
>
>
> The topic is broad and our goal is to end up with a tool useful to practitioners. If you have any advice or feedback, if you want us to try and interoperate with one of your tools: please let us know, either on this list or privately.
>
>
> Best regards,
>
> --
>
> Gabriel Kerneis
>
> Les données à caractère personnel recueillies et traitées dans le cadre de cet échange, le sont à seule fin d'exécution d'une relation professionnelle et s'opèrent dans cette seule finalité et pour la durée nécessaire à cette relation. Si vous souhaitez faire usage de vos droits de consultation, de rectification et de suppression de vos données, veuillez contacter [e-mail]. Si vous avez reçu ce message par erreur, nous vous remercions d'en informer l'expéditeur et de détruire le message. The personal data collected and processed during this exchange aims solely at completing a business relationship and is limited to the necessary duration of that relationship. If you wish to use your rights of consultation, rectification and deletion of your data, please contact: [e-mail]. If you have received this message in error, we thank you for informing the sender and destroying the message.
>
>
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats