Re: [lamps] On the need for standardization of software-based interoperable private keys [was: Re: draft-ietf-lamps-samples: PKCS12 expertise needed (including objects for comparison)]

[Michael Richardson <[e-mail]>]

Carl Wallace <[e-mail]> wrote:
    CW> I was referring to Secure Enclave in iPhones, TEE/Strong Box on
    CW> Android and TPM on Windows 10 devices. I agree these are not widely
    CW> used for email decryption, but they could be.  There certainly are
    CW> enough of them around though.

Hmm. I wasn't even thinking about my phone as a HSM.

Given that most of these devices are secured against the legal owners, do not
let me (or my IT director) decide what software I run, I'm not sure that I
feel secure enough with them for many uses.  I especially don't know how to
recover/renegated/re-enroll keys do when my phone is dropped in the toilet or
crushed under a bus.

When my previous phoned died hard, I only had two RFC 6238 profiles loaded
into my Google Authenticator.  I had my *Google* backup keys around, the
other one was ARIN, and I could phone them and authenticate.  I now have
about 12 things loaded, and I've taken the approach of *printing* the QRcodes
that initialize these to paper and putting them a file.  I have no idea how
to recover that, and the profiles don't seem to backup to google. (And maybe
that's according to plan).
I used to think like you, back when I ran Cyanogen everywhere, and thought
that we'd outgrow vendor/telco lockin on phones.  I now despair at
opportunities missed.

I don't know how I'd use the TEE in my phone with my laptop/desktop for email.
I imagine that one could run PKCS11 across the USB cable, but I'm unaware of
any actual software to do that.  That sure would be a nice thing to do.


--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide