Subject: [sacm] IEEE 802.1AR overview

From: Henk Birkholz <[email-masked]>
Date: Fri, 30 Jan 2015 10:34:59 +0100

Hello!

my action item was to provide a concise overview of IEEE 802.1AR.

IEEE 802.1AR provides cryptographically bound, unique identifiers for 
devices (DevIDs), which are composed of a secure device identifier 
secret and a secure device identifier credential. These IDs can be 
controlled by the product manufacturer (IDevID, an initially installed 
identity) or by the end-user (LDevID, a subsequent locally significant 
identity derived from the IDevID). An administrator, for example, could 
create a network-specific LDevID that is unique in the local 
administrative domain and use it for trustworthy remote administration. 
An IDevID, for example, could facilitate secure device provisioning.

Typically, an IDevID cannot be changed by the end-user. Hence, to 
provide better privacy, an administrator can disable the DevID module 
(and thereby disable access to all of the credentials or keys) or can 
limit access only to indicated LDevIDs. It is important to highlight 
that "there is no DevID credential field that allows differentiation 
between an LDevID and an IDevID generated by an unknown manufacturer."

It might also be of interest that there is an Appendix to the standard, 
which illustrates how to implement a DevID with a TPM.

Best,

Henk

---

From: <[email-masked]>
Date: Fri, 30 Jan 2015 10:03:11 +0000

Hi Henk and all

Just to add to the last paragraph of Henk¹s mail. The TCG did already go
more into the details on how to use TPMs for DevIDs (at least for TPM
1.2): 
http://www.trustedcomputinggroup.org/resources/tpm_keys_for_platform_identi
ty_for_tpm_12 This document is currently under public review (until Feb
2nd).

Best regards
Carolin