Re: [Teep] [saag] BOFs about IoT firmware update and TEE configuration

[Hannes Tschofenig <[e-mail]>]

Hi Eliot,


(I put the TEEP mailing list on CC since they may be interested in this
conversation as well.)

The use case for TEEP is a bit different.

The idea is to configure software running on a trusted execution
environment. While the currently proposed solution assumes a PKI and the
use of asymmetric key cryptography it does not use 802.1AR certificates.
There is no notion of a local network since it does not matter. The
document also does not talk about how the messages are conveyed but HTTP
is more likely for the smart phone/tablet use cases.


I created a slide deck for presentation at the T2TRG meeting at the
Berlin IETF but unfortunately there was no time. Nevertheless, here is
the slide deck:
https://github.com/t2trg/2016-ietf96/blob/master/slides/70_OTrP-IETF93.pdf

Does this provide enough information about the intention?

Ciao
Hannes

On 02/20/2017 03:58 PM, Eliot Lear wrote:
> Hi Hannes,
> 
> First, Max, Michael, Michael, and Kent are far more the experts than I
> am on this, but here is a brief summary:
> 
> The purpose of  draft-ietf-anima-bootstrap-keyinfra is to provide a
> trusted introduction between devices and the network such that you start
> in the following state:
> 
> Device has a manufacturer certificate (802.1AR iDevID) and a
> manufacturer trust root, and the local network can in some way
> authenticate the manufacturer, and perhaps visa versa.  The end state is
> that the device has a local (802.1 LDevID) and a local trust anchor.  To
> accomplish this, a flow is defined to get to the point where the device
> will register with a local registrar using EST (either EST or EST/CoAP).
> 
> Now perhaps you could explain a little about the TEE draft you're doing?
> 
> If there's some overlap perhaps there's a chance to consolidate the work.
> 
> Eliot
> 
> 
> 
> On 2/18/17 5:17 PM, Hannes Tschofenig wrote:
>> Hi Eliot,
>>
>> I actually don't know since I never understood the ANIMA work all that
>> well due to its fuzzy scope. I suspect that you can answer the question
>> better than I do.
>>
>> Ciao
>> Hannes
>>
>> On 02/13/2017 02:29 PM, Eliot Lear wrote:
>>> Hannes,
>>>
>>> Can you say a few words about how TEE compares to
>>> draft-ietf-anima-bootstrap-keyinfra (et al) which has been in
>>> development in a WG for quite some time?
>>>
>>> Eliot
>>>
>>>
>>> On 2/13/17 12:51 PM, Hannes Tschofenig wrote:
>>>> Hi all,
>>>>
>>>> we have proposed two security-relevant BOFs for the upcoming meeting.
>>>> They are listed on the BOF Wiki page at
>>>> https://trac.tools.ietf.org/bof/trac/wiki but I still wanted to briefly
>>>> introduce them to you
>>>>
>>>> ** “Firmware Update Description (FUD)”
>>>>
>>>> Last year we had a workshop organized by the IAB on firmware updates for
>>>> IoT devices (see https://www.iab.org/activities/workshops/iotsu/) where
>>>> we talked about various challenges and gaps.
>>>>
>>>> As a follow-up to the workshop we would like to initiate some
>>>> standardization activity in this area.
>>>>
>>>> The mailing list can be found at
>>>> https://www.ietf.org/mailman/listinfo/fud
>>>>
>>>>
>>>> ** “A Protocol for Dynamic Trusted Execution Environment Enablement (TEEP)”
>>>>
>>>> This BOF is about an application layer security protocol that allows to
>>>> configure security credentials and software running on a Trusted
>>>> Execution Environment (TEE). Today, TEEs are, for example, found home
>>>> routers, set-top boxes, smart phones, tablets, wearables, etc.
>>>> Unfortunately, there have been mostly proprietary protocols used in this
>>>> environment.
>>>>
>>>> With this BOF we are making an attempt to standardize such a protocol. A
>>>> strawman proposal of such a protocol has been published with
>>>> https://tools.ietf.org/html/draft-pei-opentrustprotocol-03.
>>>>
>>>> The mailing list can be found at:
>>>> https://www.ietf.org/mailman/listinfo/teep
>>>>
>>>>
>>>>
>>>>
>>>> Ciao
>>>> Hannes
>>>>
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> saag mailing list
>>>> [e-mail]
>>>> https://www.ietf.org/mailman/listinfo/saag
> 
>