Re: [saag] BOFs about IoT firmware update and TEE configuration

[Eliot Lear <[e-mail]>]

Great start, thanks!  Will contact you offline to further discuss.

Eliot


On 2/22/17 9:15 AM, Hannes Tschofenig wrote:
> Hi Eliot,
>
>
> (I put the TEEP mailing list on CC since they may be interested in this
> conversation as well.)
>
> The use case for TEEP is a bit different.
>
> The idea is to configure software running on a trusted execution
> environment. While the currently proposed solution assumes a PKI and the
> use of asymmetric key cryptography it does not use 802.1AR certificates.
> There is no notion of a local network since it does not matter. The
> document also does not talk about how the messages are conveyed but HTTP
> is more likely for the smart phone/tablet use cases.
>
>
> I created a slide deck for presentation at the T2TRG meeting at the
> Berlin IETF but unfortunately there was no time. Nevertheless, here is
> the slide deck:
> https://github.com/t2trg/2016-ietf96/blob/master/slides/70_OTrP-IETF93.pdf
>
> Does this provide enough information about the intention?
>
> Ciao
> Hannes
>
> On 02/20/2017 03:58 PM, Eliot Lear wrote:
>> Hi Hannes,
>>
>> First, Max, Michael, Michael, and Kent are far more the experts than I
>> am on this, but here is a brief summary:
>>
>> The purpose of  draft-ietf-anima-bootstrap-keyinfra is to provide a
>> trusted introduction between devices and the network such that you start
>> in the following state:
>>
>> Device has a manufacturer certificate (802.1AR iDevID) and a
>> manufacturer trust root, and the local network can in some way
>> authenticate the manufacturer, and perhaps visa versa.  The end state is
>> that the device has a local (802.1 LDevID) and a local trust anchor.  To
>> accomplish this, a flow is defined to get to the point where the device
>> will register with a local registrar using EST (either EST or EST/CoAP).
>>
>> Now perhaps you could explain a little about the TEE draft you're doing?
>>
>> If there's some overlap perhaps there's a chance to consolidate the work.
>>
>> Eliot
>>
>>
>>
>> On 2/18/17 5:17 PM, Hannes Tschofenig wrote:
>>> Hi Eliot,
>>>
>>> I actually don't know since I never understood the ANIMA work all that
>>> well due to its fuzzy scope. I suspect that you can answer the question
>>> better than I do.
>>>
>>> Ciao
>>> Hannes
>>>
>>> On 02/13/2017 02:29 PM, Eliot Lear wrote:
>>>> Hannes,
>>>>
>>>> Can you say a few words about how TEE compares to
>>>> draft-ietf-anima-bootstrap-keyinfra (et al) which has been in
>>>> development in a WG for quite some time?
>>>>
>>>> Eliot
>>>>
>>>>
>>>> On 2/13/17 12:51 PM, Hannes Tschofenig wrote:
>>>>> Hi all,
>>>>>
>>>>> we have proposed two security-relevant BOFs for the upcoming meeting.
>>>>> They are listed on the BOF Wiki page at
>>>>> https://trac.tools.ietf.org/bof/trac/wiki but I still wanted to briefly
>>>>> introduce them to you
>>>>>
>>>>> ** “Firmware Update Description (FUD)”
>>>>>
>>>>> Last year we had a workshop organized by the IAB on firmware updates for
>>>>> IoT devices (see https://www.iab.org/activities/workshops/iotsu/) where
>>>>> we talked about various challenges and gaps.
>>>>>
>>>>> As a follow-up to the workshop we would like to initiate some
>>>>> standardization activity in this area.
>>>>>
>>>>> The mailing list can be found at
>>>>> https://www.ietf.org/mailman/listinfo/fud
>>>>>
>>>>>
>>>>> ** “A Protocol for Dynamic Trusted Execution Environment Enablement (TEEP)”
>>>>>
>>>>> This BOF is about an application layer security protocol that allows to
>>>>> configure security credentials and software running on a Trusted
>>>>> Execution Environment (TEE). Today, TEEs are, for example, found home
>>>>> routers, set-top boxes, smart phones, tablets, wearables, etc.
>>>>> Unfortunately, there have been mostly proprietary protocols used in this
>>>>> environment.
>>>>>
>>>>> With this BOF we are making an attempt to standardize such a protocol. A
>>>>> strawman proposal of such a protocol has been published with
>>>>> https://tools.ietf.org/html/draft-pei-opentrustprotocol-03.
>>>>>
>>>>> The mailing list can be found at:
>>>>> https://www.ietf.org/mailman/listinfo/teep
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> Ciao
>>>>> Hannes
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> saag mailing list
>>>>> [e-mail]
>>>>> https://www.ietf.org/mailman/listinfo/saag
>>