[Rats] Debugging remote attestation with a phone

[Kerneis Gabriel <[e-mail]>]

Dear all,


TL;DR: looking for feedback and advice implementing TPM remote attestation over bluetooth; offering to attempt independent implementation of relevant RFC drafts as a way to contribute to this WG's interests.


I have followed this group for a couple months now, but didn't introduce myself before. I am a security researcher at ANSSI<http://ssi.gouv.fr>, the French cybersecurity agency, working on firmware (and related OS) security.


Starting in a couple of weeks, we'll be hosting an intern for 6 months with the aim of implementing a phone application acting as a remote attestation server over Bluetooth. We envision it as a user-friendly, versatile tool to help debugging secure/measured boot issues as well as (potentially) a second-factor delivering secrets to the laptop. I wrote a blog post to summarise my understanding of the state-of-the-art, including how it relates to RATS (that I was just discovering at the time): TPM remote attestation over Bluetooth<https://gabriel.kerneis.info/2021/11/local_attestation/>. We consider implementing the CoAP protocol described in ?appendix A of RIM<https://datatracker.ietf.org/doc/html/draft-ietf-rats-reference-interaction-models#appendix-A>, but could go in other directions (eg. the attestation protocol used by safeboot.net<http://safeboot.net>).


The topic is broad and our goal is to end up with a tool useful to practitioners. If you have any advice or feedback, if you want us to try and interoperate with one of your tools: please let us know, either on this list or privately.


Best regards,

--

Gabriel Kerneis

Les données à caractère personnel recueillies et traitées dans le cadre de cet échange, le sont à seule fin d'exécution d'une relation professionnelle et s'opèrent dans cette seule finalité et pour la durée nécessaire à cette relation. Si vous souhaitez faire usage de vos droits de consultation, de rectification et de suppression de vos données, veuillez contacter [e-mail]. Si vous avez reçu ce message par erreur, nous vous remercions d'en informer l'expéditeur et de détruire le message. The personal data collected and processed during this exchange aims solely at completing a business relationship and is limited to the necessary duration of that relationship. If you wish to use your rights of consultation, rectification and deletion of your data, please contact: [e-mail]. If you have received this message in error, we thank you for informing the sender and destroying the message.