Re: [Teep] Working Group Last Call for HTTP Transport for Trusted Execution Environment Provisioning: Agent-to-TAM Communication

[Benjamin Kaduk <[e-mail]>]

[quoting is a bit busted, since color doesn't make it into text/plain]

On Wed, Apr 01, 2020 at 02:37:52AM +0000, Dave Thaler wrote:
>     
> 
>     
> 
>    From: TEEP <[e-mail]> On Behalf Of Konda, Tirumaleswar Reddy
>    Sent: Saturday, March 14, 2020 11:05 PM
>    To: [e-mail]
>    Subject: Re: [Teep] Working Group Last Call for HTTP Transport for Trusted
>    Execution Environment Provisioning: Agent-to-TAM Communication
>     
> 
>    5)  HTTP is susceptible to several attacks including pervasive monitoring,
>    any specific reason to support HTTP ?
> 
>     
> 
>    For debugging purposes before putting it into production.

It's not really clear to me that we need to include something in the
protocol spec that's just for debugging.  Do we really think people will
not figure out that they can use non-TLS HTTP for locally debugging an
HTTPS-based protocol?

>    Also some argue that since TEEP already does its own security layer
>    inside, the value of multiple layers of security
> 
>    Is diminished, especially if you're a constrained node looking to reduce
>    code size.   The text in the security consideration

(IMO the multiple layers do different things and complement each other, in
general.  I guess I haven't looked at this specific protocol in detail yet
but there's a general theme across protocols.)

-Ben