[Rats] Android attestations: Re: draft-richardson-rats-usecases-00 comments

[Anders Rundgren <[e-mail]>]

Here you have another link:
https://developer.android.com/training/articles/security-key-attestation

As an application developer I find this scheme and the associated "AndroidKeyStore" quite impractical.
The recent addition of "StrongBox" makes it worse.

With a two-level TEE/SE session-key based scheme you only need to attest the session permitting you to perform any number of secure operations and close the session with a "commit" which in turn responds with a (session signed) message to the SP that everything went right.

Anders

On 2019-04-18 15:06, Thomas Fossati wrote:
> Hi Michael,
> 
> On 27/03/2019, 18:25, "RATS on behalf of Michael Richardson" <[e-mail] on behalf of [e-mail]> wrote:
>> (Still looking for some pointers to *attestion* parts of the Android KeyStore.)
> 
> Maybe you want to take a look at [1]
> 
> Cheers, t
> 
> [1] https://arxiv.org/pdf/1904.05572.pdf
> 
> 
> 
> 
> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
> _______________________________________________
> RATS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rats
>