Re: [Rats] Dealing with Attestation Roots

[Anders Rundgren <[e-mail]>]

Any takers out there?
I could consider writing an I-D.
/Anders

On 2020-02-27 18:51, Anders Rundgren wrote:
> Hi List,
> In the https://cyberphone.github.io/openbankingwallet project the idea was to use attestations.  The most recent version of the Android app indeed supports this as well.
> 
> In an ideal world the root would be provided by Google.  However, since we don't live in an ideal world there are vendors out there who do not follow that "recipe".
> 
> For W3C's PaymentRequest API a simpler solution is used which do not match attestations but is better than nothing.  This scheme builds on publishing a manifest associated with the app.  Here is my particular manifest:  https://mobilepki.org/w3cpay/method
> 
> But I still would like to use attestations and also not being tied to browsers.
> 
> What about making attestations optionally contain a URL to the root like https://huawei.com/teeroot ?
> Since the number of vendors in finite and the Web-PKI is in a fairly good shape these days, this could serve as a workaround for those who don't have any number of cycles to spend on installing arbitrary tee root certificates.  That is, a verifier's "trust registry" would simply hold host names like "huawei.com", "sony.com", "samsung.com", etc.
> 
> If there is a better method, I'm all ears!
> 
> thanx,
> Anders
>