[Teep] use case document comments

[Michael Richardson <[e-mail]>]

Thank you for the use case document.
I think that there is a need in the use case document to explain who owns the
code inside the TEE.  (It seems that a device like a smartphone would need a
multitude of TEEs)

3.1. Use Case 1 - Payment

So on the one hand the document suggests that the TEE will contain personal
information relating to payment, so be securely unlocked by the end user via
some kind of SecureAttentionKey interface.   A private key, or perhaps an
anchor for a blockchain signer....
So the end user needs to intimately control what code is inside (i.e: be able
to delegate that trust to a party that they trust).

Then the document says:
     For the development of the relevant TA of SP, the
     use of OTrP can easily send the latest trusted application to the
     device.

I get the impression that the bank is going to send updates to the trust
application.   But, it's the bank that I'm going to dispute a payment with,
so in fact, I can't let them create the audit trail at my end.

No use case was given for media, yet that was mentioned.
Nor Enterprise.

In each case, I think that the contents of the TEE are controlled by a
different party.  And each party seems to want to control the screen and
keyboard.


3.2.  Use Case 2 - IoT

The only example here given is smart door locks.
I think that this is really confused.   The most important thing the TEE can
do is to provide original bootstrap process, and then yes, storage and update
of session keys.   After putting all that in the TEE, what's actually left?


====

Based upon what I have read so far, I can't see a role for the IETF, but I
continue to read with an open mind.

--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-