[Teep] OTrP Proposal - Chunking Data to Conserve RAM

[Anders Rundgren <[e-mail]>]

Hi fellow TEEers,

As some of you know I have been working for a long time on a concept coined SKS/KeyGen2 which is about using a TA (or HW) as a universal keystore and then be able managing keys in an E2ES (End to End Security) fashion over the Web.

Since the data structures you can create with the management protocol (KeyGen2) are arbitrary complex, a naive approach would require an equally arbitrary amount of RAM.  Since RAM vs FLASH/ROM typically differ with a factor of 10 or more, I simply had to come up with a better solution.

The solution I found was to creating a _session_key_ and do things in _steps_.  This allows the system to use a non-encrypted (but MACed) API and only encrypt data which absolutely needs encryption. Another benefit is that the protocol can work on (what appears to be) a high level including aggregation of API calls.

https://cyberphone.github.io/doc/security/keygen2.html#Sample_Run

Are there downsides to this you may wonder?  Of course, _all_ solutions have such :-)
If a session is abruptly terminated you may end up with a bricked system.

Workaround:  The SKS (Secure Key Store) builds on a transaction concept so that nothing is "committed" (inside of it) until the last call has been _successfully_performed_.

There's another important benefit of the session key approach: Format independency on the protocol side since the API only needs to process low-level binary. That is, OTrP could be dressed in JSON and CBOR without _any_ protocol/API level adjustments.

This is not only a nice theory, a public PoC using a "soft" SKS is available for anybody having 5-10 minutes to spend:
https://test.webpki.org/webpay-merchant
https://play.google.com/store/apps/details?id=org.webpki.mobile.android

The next [anticipated] step on this project is transcending cryptographic keys to become first-class OS objects like Files, Processes, Users, etc. which I recently presented at Linaro Connect in Budapest.

Cheers,
Anders
https://priorart.ip.com/IPCOM/000215433