Re: [Teep] [EXT] Re: Call for adoption

[Nicolae Paladi <[e-mail]>]

Hi Mingliang, 

thank you for the clarifications. Comments and suggestions inline.

> On 10 May 2018, at 04:51, Mingliang Pei <[e-mail]> wrote:
> 
> Hi Nicolae,
>  
> Thank you very much for your comments. Sorry for delayed reply. Please see my comments inline.
>  
> Best,
>  
> Ming
>  
> From: Nicolae Paladi <[e-mail] <mailto:[e-mail]>>
> Date: Friday, May 4, 2018 at 2:35 AM
> To: Mingliang Pei <[e-mail] <mailto:[e-mail]>>
> Cc: Dave Thaler <[e-mail] <mailto:[e-mail]>>, "Wheeler, David M" <[e-mail] <mailto:[e-mail]>>, "Nancy Cam-Winget (ncamwing)" <[e-mail] <mailto:[e-mail]>>, "[e-mail] <mailto:[e-mail]>" <[e-mail] <mailto:[e-mail]>>
> Subject: Re: [Teep] [EXT] Re: Call for adoption
>  
> Hello, 
>  
> I have read through the 06 OTrP document; besides a list of miscellaneous omissions and minor misses (that can be addressed later), several points caught my eye:
>  
> 1. In §5.2 the acronym “AIK” from  "TEE SP anonymous key (AIK)” reads very similar to the concept of an “Attestation Identity Key”  (e.g. from [1]). 
> Is that the purpose? If yes, the key and its role should be introduced, otherwise a different acronym could be used.
>  
> Ming: it is different. The TAM will still know a device’s identity basing on TEE key and we introduced AIK to make the application itself no need to access TEE device key. We were aware of DAA but didn’t make it a requirement to use.

Nicolae: I understand; in ANY that case it should be introduced in the acronym list (I assume it is an acronym; would be nice to know what it stands for), and also explained in the text body.

>  
> 2. In §6.3.1 the draft mentions that “It is important to ensure a legitimate OTrP Agent is installed”. 
> However, it is not clear what a “legitimate” agent is and how one can ensure that a “legitimate” agent installed.
> Given that the agent runs in the REE where the applications are by definition un-trusted (as per 3.1), this paragraph leads to a dead end.
> What is the relation between a “legitimate” application and a “trusted” application?
>  
> Ming: “trusted” application refers to those running in TEE side. You are right, an OTrP Agent cannot be always trusted. We recommend that it is installed as a “system” app that has better protection than a user installed app. If an OTrP agent applicaton is compromised, it cannot steal anything because data is encrypted end-to-end, and TAM will detect it. One threat is that it may cause Denial-of-service to TA management requests. Thanks for your comment; we can elaborate this in “Security Consideration” section. How do you think?
>  

Nicolae: I think discussing the security aspects of the OTrP Agent in the “Security Consideration” section is a good idea. 
I would actually move the sentence “It is important to ensure a legitimate OTrP Agent is installed” also to the “Security Consideration” section - to both motivate this importance, outline the risks and suggest mitigations. 
Otherwise it does not help to underly this importance if earlier in the text the REE was declared untrusted.

> 3. §6.3.2 states twice (duplication) that only one OTrP agent is expected. 
> However, given that “a user can dynamically download and install an OTrP Agent on demand” (as per §6.3.1), it is unclear what this expectation is based on.
> Moreover, the interaction is multiple OTrP agents on the platform is not discussed.
>  
> Ming: the OTrP assumes that only one active TEE is installed in a device, see Section 12 and 7.8 etc. You raised a good point on what if a user downloads multiple OTrP agent. It was expected that one “system” OTrP agent is used that associates with the underlying TEE. Supporting multiple different OTrP agents are out of scope for the spec. The focus is on the “messaging protocol” that are exchanged. How an OTrP agent is installed and interact with TEE are left out for implementations. We will add clarification about this. Thanks again for your questions here.

Nicolae: Sounds good; explicitly marking the scope and the assumptions here will be helpful.

>  
> Best regards,
> Nicolae
>  
> ====
>  
> [1] Ernie Brickell, Jan Camenisch, and Liqun Chen. 2004. Direct anonymous attestation. In Proceedings of the 11th ACM conference on Computer and communications security (CCS '04). ACM, New York, NY, USA, 132-145. DOI=http://dx.doi.org/10.1145/1030083.1030103 <https://clicktime.symantec.com/a/1/FxLZJM03ASlro3ApjZyFHa5jrFqUjyGpGhjI8XOC1X0=?d=m6C10soKZjsw33Z3WzAqLgXYspcBsudM2nUIfa1o0mmI03HqQ3KmRq1gQ2LCFHBvg6I_OCTwg9HEo-dSm9GWB1bai4z4g8oPYU-p9tvCtkLwnCy4XjNiYWHbl4hDBH1XBYV8wONzxnXr3_pxkjPJv8WkoTMlSt9kJV42Y2m5Y6EcNmMOWivqcLhKm0lFJ44NGD-R9LhdGU01v3MaL4Q2vQLBoHZf9oeauDDsrxmN00kEuGowOuW_wVcXsjWfKOzsR_RAvXEzRIDUUhQn-vVpxQrjYSu1Mfi_s0pTQZEqHMstUlVcOKHfXLRAdqdDiEhKKMxBfiUAe5Kc56UJbDPDC85eOx4MiH5B1iBb3v3X8Itd_-TGNkGS8SbbGdgcn-c%3D&u=http%3A%2F%2Fdx.doi.org%2F10.1145%2F1030083.1030103>
>  
>  
>> On 02 May 2018, at 20:23, Mingliang Pei <[e-mail] <mailto:[e-mail]>> wrote:
>>  
>> Thanks Dave T, that is correct.
>>  
>> Hi Dave W, yes, I can confirm that it is exactly the same version as v06 OTrP except a few typo fixes. The plan is to rename the “adopted” version v06 first to WG named draft, and we work on revision from there with full continuity.
>>  
>> Thanks,
>>  
>> Ming
>>  
>> From: Dave Thaler <[e-mail] <mailto:[e-mail]>>
>> Date: Wednesday, May 2, 2018 at 10:13 AM
>> To: "Wheeler, David M" <[e-mail] <mailto:[e-mail]>>, Mingliang Pei <[e-mail] <mailto:[e-mail]>>, "Nancy Cam-Winget (ncamwing)" <[e-mail] <mailto:[e-mail]>>, "[e-mail] <mailto:[e-mail]>" <[e-mail] <mailto:[e-mail]>>
>> Subject: RE: [Teep] [EXT] Re: Call for adoption
>>  
>> You can see the diffs at
>>  
>> I see that a number of typos were fixed, but there were no substantial differences.
>>  
>> Dave
>>  
>> From: TEEP <[e-mail] <mailto:[e-mail]>> On Behalf Of Wheeler, David M
>> Sent: Wednesday, May 2, 2018 7:14 AM
>> To: Mingliang Pei <[e-mail] <mailto:[e-mail]>>; Nancy Cam-Winget (ncamwing) <[e-mail] <mailto:[e-mail]>>; [e-mail] <mailto:[e-mail]>
>> Subject: Re: [Teep] [EXT] Re: Call for adoption
>>  
>> Ming,
>> Can you just confirm that there are NO DIFFERENCES between the last released version and the 06 OTrP document?
>> If there are differences, can you give a short summary so I know where to look?
>> Much appreciated,
>> Dave Wheeler
>>  
>>  
>>  <>From: TEEP [mailto:[e-mail] <mailto:[e-mail]>] On Behalf Of Mingliang Pei
>> Sent: Thursday, April 26, 2018 10:46 AM
>> To: Nancy Cam-Winget (ncamwing) <[e-mail] <mailto:[e-mail]>>; [e-mail] <mailto:[e-mail]>
>> Subject: Re: [Teep] [EXT] Re: Call for adoption
>>  
>> Thank you Nancy, Dave and all for your support, comments and suggestions.
>>  
>> Yes, I will rename the draft to “draft-ietf-teep-opentrustprotocol” and resubmit it very soon.
>>  
>> Thanks, again,
>>  
>> Ming
>>  
>> From: TEEP <[e-mail] <mailto:[e-mail]>> on behalf of "Nancy Cam-Winget (ncamwing)" <[e-mail] <mailto:[e-mail]>>
>> Date: Thursday, April 26, 2018 at 8:58 AM
>> To: "[e-mail] <mailto:[e-mail]>" <[e-mail] <mailto:[e-mail]>>
>> Subject: [EXT] Re: [Teep] Call for adoption
>>  
>> Hearing (or reading) no strong objections, “draft-pei-opentrustprotocol” is adopted by the WG.
>>  
>> A few comments have already been provided that can be addressed in subsequent versions some can also be clarified in the architecture draft.
>>  
>> Ming: when you get a chance, please submit the draft with the name:  draft-ietf-teep-opentrustprotocol
>>  
>> Your chairs, Dave and Nancy
>>  
>> From: "[e-mail] <mailto:[e-mail]>" <[e-mail] <mailto:[e-mail]>>
>> Date: Monday, April 2, 2018 at 11:07 AM
>> To: "[e-mail] <mailto:[e-mail]>" <[e-mail] <mailto:[e-mail]>>
>> Subject: Call for adoption
>>  
>> All, <>
>>  
>> There was strong interest and consensus at the TEEP f2f IETF 101 meeting in London for adopting
>> https://datatracker.ietf.org/doc/draft-pei-opentrustprotocol/ <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fclicktime.symantec.com%2Fa%2F1%2FgRKJSsq7kQhfqIKwz5wHUYr68TvGP5gAqpJNYBP-b7k%3D%3Fd%3D8WYzqysvQkd-X_pG-TDgQWMOhCT_hZ1FSVct6-8Ei0YXDodJ-BlC1HRZVDivUH6gtXKkOaBplQ4cm5LXvKuOoc75nlsRDpZ0rTVUq3fI7jVSXjtiB2k5l62ztuPK_5u9S0O3mA7XFXurjMVspCv9uWGRny0TCxWJTwmktVrcQ-LZsoLDB69BN4KytF_Po_2Z2uln01QFKhgSZXUOR-YCo0fpFWZNBDKlXao5KGMKu-LMjD9wwhzQSXXsEgOk-r_0Vzw4CArYfYfPSqkGXkT1bJegLFfBHZZ6RGWMovT3TJ8Z2EohP6RQgIWuG16Z_L_WaaiTJKC75JKHUnWLAF4IObMDfaL4frUNdI7SaFJEk1Nym6ab%26u%3Dhttps%253A%252F%252Fdatatracker.ietf.org%252Fdoc%252Fdraft-pei-opentrustprotocol%252F&data=02%7C01%7Cdthaler%40microsoft.com%7C7a6910317f434c0cf7e508d5b036f02f%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C636608672364767599&sdata=4N1Xkn78OMBQeskfI6i%2FOe4R37Hw%2BcOELBqt06w6x%2FY%3D&reserved=0>  as a draft protocol.
>>  
>> This is a call for adoption as a working group draft .  If you have any concerns or objections please respond
>> by April 16th.
>>  
>> Warm regards, Nancy
>> _______________________________________________
>> TEEP mailing list
>> [e-mail] <mailto:[e-mail]>
>> https://www.ietf.org/mailman/listinfo/teep <https://clicktime.symantec.com/a/1/mXucsNPSYG5NsyN9moI8H8Nv5l3RsIzSmWatmV1beas=?d=m6C10soKZjsw33Z3WzAqLgXYspcBsudM2nUIfa1o0mmI03HqQ3KmRq1gQ2LCFHBvg6I_OCTwg9HEo-dSm9GWB1bai4z4g8oPYU-p9tvCtkLwnCy4XjNiYWHbl4hDBH1XBYV8wONzxnXr3_pxkjPJv8WkoTMlSt9kJV42Y2m5Y6EcNmMOWivqcLhKm0lFJ44NGD-R9LhdGU01v3MaL4Q2vQLBoHZf9oeauDDsrxmN00kEuGowOuW_wVcXsjWfKOzsR_RAvXEzRIDUUhQn-vVpxQrjYSu1Mfi_s0pTQZEqHMstUlVcOKHfXLRAdqdDiEhKKMxBfiUAe5Kc56UJbDPDC85eOx4MiH5B1iBb3v3X8Itd_-TGNkGS8SbbGdgcn-c%3D&u=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fteep>
>  
> _______________________________________________
> TEEP mailing list
> [e-mail] <mailto:[e-mail]>
> https://www.ietf.org/mailman/listinfo/teep <https://www.ietf.org/mailman/listinfo/teep>