Re: [saag] BOFs about IoT firmware update and TEE configuration

[Eliot Lear <[e-mail]>]

Hi Hannes,

First, Max, Michael, Michael, and Kent are far more the experts than I
am on this, but here is a brief summary:

The purpose of  draft-ietf-anima-bootstrap-keyinfra is to provide a
trusted introduction between devices and the network such that you start
in the following state:

Device has a manufacturer certificate (802.1AR iDevID) and a
manufacturer trust root, and the local network can in some way
authenticate the manufacturer, and perhaps visa versa.  The end state is
that the device has a local (802.1 LDevID) and a local trust anchor.  To
accomplish this, a flow is defined to get to the point where the device
will register with a local registrar using EST (either EST or EST/CoAP).

Now perhaps you could explain a little about the TEE draft you're doing?

If there's some overlap perhaps there's a chance to consolidate the work.

Eliot



On 2/18/17 5:17 PM, Hannes Tschofenig wrote:
> Hi Eliot,
>
> I actually don't know since I never understood the ANIMA work all that
> well due to its fuzzy scope. I suspect that you can answer the question
> better than I do.
>
> Ciao
> Hannes
>
> On 02/13/2017 02:29 PM, Eliot Lear wrote:
>> Hannes,
>>
>> Can you say a few words about how TEE compares to
>> draft-ietf-anima-bootstrap-keyinfra (et al) which has been in
>> development in a WG for quite some time?
>>
>> Eliot
>>
>>
>> On 2/13/17 12:51 PM, Hannes Tschofenig wrote:
>>> Hi all,
>>>
>>> we have proposed two security-relevant BOFs for the upcoming meeting.
>>> They are listed on the BOF Wiki page at
>>> https://trac.tools.ietf.org/bof/trac/wiki but I still wanted to briefly
>>> introduce them to you
>>>
>>> ** “Firmware Update Description (FUD)”
>>>
>>> Last year we had a workshop organized by the IAB on firmware updates for
>>> IoT devices (see https://www.iab.org/activities/workshops/iotsu/) where
>>> we talked about various challenges and gaps.
>>>
>>> As a follow-up to the workshop we would like to initiate some
>>> standardization activity in this area.
>>>
>>> The mailing list can be found at
>>> https://www.ietf.org/mailman/listinfo/fud
>>>
>>>
>>> ** “A Protocol for Dynamic Trusted Execution Environment Enablement (TEEP)”
>>>
>>> This BOF is about an application layer security protocol that allows to
>>> configure security credentials and software running on a Trusted
>>> Execution Environment (TEE). Today, TEEs are, for example, found home
>>> routers, set-top boxes, smart phones, tablets, wearables, etc.
>>> Unfortunately, there have been mostly proprietary protocols used in this
>>> environment.
>>>
>>> With this BOF we are making an attempt to standardize such a protocol. A
>>> strawman proposal of such a protocol has been published with
>>> https://tools.ietf.org/html/draft-pei-opentrustprotocol-03.
>>>
>>> The mailing list can be found at:
>>> https://www.ietf.org/mailman/listinfo/teep
>>>
>>>
>>>
>>>
>>> Ciao
>>> Hannes
>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> saag mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/saag