Subject: [Teep] WG Action: Formed Trusted Execution Environment Provisioning (teep)

From: The IESG <[email-masked]>
Date: Fri, 09 Mar 2018 09:31:04 -0800

A new IETF WG has been formed in the Security Area. For additional
information, please contact the Area Directors or the WG Chairs.

Trusted Execution Environment Provisioning (teep)
-----------------------------------------------------------------------
Current status: BOF WG

Chairs:
  Nancy Cam-Winget <[email-masked]>
  Dave Thaler <[email-masked]>

Assigned Area Director:
  Kathleen Moriarty <[email-masked]>

Security Area Directors:
  Kathleen Moriarty <[email-masked]>
  Eric Rescorla <[email-masked]>

Mailing list:
  Address: [email-masked]
  To subscribe: https://www.ietf.org/mailman/listinfo/teep
  Archive: https://mailarchive.ietf.org/arch/browse/teep/

Group page: https://datatracker.ietf.org/group/teep/

Charter: https://datatracker.ietf.org/doc/charter-ietf-teep/

The Trusted Execution Environment (TEE) is a secure area of a processor. The
TEE provides security features such as isolated execution and integrity of
Trusted Applications, along with provisions for maintaining the
confidentiality of their assets. In general terms, the TEE offers an
execution space that provides a higher level of security than a "rich"
operating system and more functionality than a secure element. For example,
implementations of the TEE concept have been developed by ARM and Intel,
using the TrustZone and the SGX technology, respectively.

To programmatically install, update, and delete applications in a TEE, the
Trusted Execution Environment Provisioning protocol runs between a service
within the TEE on a given device, a relay application or service access point
on the device's network stack and a server-side infrastructure that interacts
with and optionally maintains the applications. Some tasks are security
sensitive and the server side requires information about the device
characteristics in the form of attestation and the device-side may require
information about the server.

Privacy considerations have to be taken into account with authentication
features and attestation.

This working group aims to develop an a protocol providing TEEs with
lifecycle management and security domain management for trusted applications.

A security domain allows a service provider's applications to be isolated so
that one security domain cannot be influenced by another domain, unless the
domain exposes an API to allow inter-domain interactions.

The solution approach must take a wide range of TEE and relevant technologies
into account and will focus on the use of public key cryptography.

The group will produce the following deliverables. The first document is on
architecture, describing the involved entities, their relationships,
assumptions, the keying framework, and relevant use cases. Second, a solution
document that includes the above-described functionality in a protocol will
be developed. The choice of encoding format(s) will be decided in the working
group. The group may document several attestation technologies considering
the different hardware capabilities, performance, privacy, and operational
properties.

The group will maintain a close relationship with the IETF SUIT working
group, GlobalPlatform, Trusted Computing Group, and other relevant standards
groups to ensure interoperability, compatibility, and proper use of existing
TEE-relevant application layer interfaces.

Milestones:

  Mar 2018 - Adopt an Architecture document

  Mar 2018 - Adopt a solution document

  Aug 2018 - Progress Solution document to the IESG for publication

  Dec 2018 - Begin WGLC for Architecture document

  Jan 2019 - Progress Architecture document to the IESG for publication

  Jul 2019 - Begin WGLC for Solution document

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 12 Mar 2018 06:51:20 +0000

Thanks to the chairs and the ADs for the hard work. It required many emails, discussions and presentations during the last year to get to this stage.

Ciao
Hannes

-----Original Message-----
From: TEEP [mailto:[email-masked]] On Behalf Of The IESG
Sent: 09 March 2018 18:31
To: IETF-Announce
Cc: [email-masked]; The IESG; [email-masked]
Subject: [Teep] WG Action: Formed Trusted Execution Environment Provisioning (teep)

A new IETF WG has been formed in the Security Area. For additional information, please contact the Area Directors or the WG Chairs.

Chairs:

Assigned Area Director:

Security Area Directors:

Mailing list:
  Address: [email-masked]

The Trusted Execution Environment (TEE) is a secure area of a processor. The TEE provides security features such as isolated execution and integrity of Trusted Applications, along with provisions for maintaining the confidentiality of their assets. In general terms, the TEE offers an execution space that provides a higher level of security than a "rich"
operating system and more functionality than a secure element. For example, implementations of the TEE concept have been developed by ARM and Intel, using the TrustZone and the SGX technology, respectively.

To programmatically install, update, and delete applications in a TEE, the Trusted Execution Environment Provisioning protocol runs between a service within the TEE on a given device, a relay application or service access point on the device's network stack and a server-side infrastructure that interacts with and optionally maintains the applications. Some tasks are security sensitive and the server side requires information about the device characteristics in the form of attestation and the device-side may require information about the server.

Privacy considerations have to be taken into account with authentication features and attestation.

This working group aims to develop an a protocol providing TEEs with lifecycle management and security domain management for trusted applications.

A security domain allows a service provider's applications to be isolated so that one security domain cannot be influenced by another domain, unless the domain exposes an API to allow inter-domain interactions.

The solution approach must take a wide range of TEE and relevant technologies into account and will focus on the use of public key cryptography.

The group will produce the following deliverables. The first document is on architecture, describing the involved entities, their relationships, assumptions, the keying framework, and relevant use cases. Second, a solution document that includes the above-described functionality in a protocol will be developed. The choice of encoding format(s) will be decided in the working group. The group may document several attestation technologies considering the different hardware capabilities, performance, privacy, and operational properties.

The group will maintain a close relationship with the IETF SUIT working group, GlobalPlatform, Trusted Computing Group, and other relevant standards groups to ensure interoperability, compatibility, and proper use of existing TEE-relevant application layer interfaces.

Milestones:

_______________________________________________
TEEP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/teep
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Mingliang Pei <[email-masked]>
Date: Mon, 12 Mar 2018 18:56:28 +0000

I would also like to send my congratulation and thanks for the chairs and the ADs as well as many people in this group to get to this great milestone. We are actively working on revising RFC drafts and looking forward to working with all in the WG. Best,

Ming

On 3/11/18, 11:51 PM, "TEEP on behalf of Hannes Tschofenig" <[email-masked] on behalf of [email-masked]> wrote:

    Ciao
    Hannes

    -----Original Message-----
    From: TEEP [mailto:[email-masked]] On Behalf Of The IESG
    Sent: 09 March 2018 18:31
    To: IETF-Announce
    Cc: [email-masked]; The IESG; [email-masked]
    Subject: [Teep] WG Action: Formed Trusted Execution Environment Provisioning (teep)

    
    Chairs:
    
    Assigned Area Director:
    
    Security Area Directors:
    
    Mailing list:
      Address: [email-masked]
      To subscribe: https://clicktime.symantec.com/a/1/JpqWQkqWMv0EKROhzz_bCxXCaBB4YUrKNgJfo4vrRL4=?d=aU2p5blW_uklcUicQ_nZaeEmhyB6f7xhfJjbXL0FWAgJDhjagymBlc9seCk4qQKPxr_cf-2HynMH-71NB3n8EfsRHa91bkskoQsT8k2WQBH1tNECgmuSydQM7Y8Vmufpky4d2ijdC39Z152WYGLiOKIb06AG8zu6cDoCD876hGthdsj81uu4YTzPFwumtNOhcaQoa5R6RGtav3cq-psk6QcapfAYQ_oQWvfYYlIwlDUJdbA56jht0ilnRECf9eluYH3vfxEWxeZhVLv6zKLxxxhwMgsf7Ei-dEwUbFQtU-59snkae4-96YG0jf0BwskYxGAgr4pAToAat5MAolz4P-Cm9JcVDXo1vQp7MrazBfjO3do3uZ2tHbMUjM3G_wUCE1xARUEhjp1tR9smilQpOJS3rK1OpAA8dFhz2nlKnJzTjyqqVEitL7rnYyl3m0yhl5F2YAHC-alPnB0GKoQPL5LZIheCVW1M27M%3D&u=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fteep
      Archive: https://clicktime.symantec.com/a/1/LBUgni_72K8c6gOlC9CUxOnEyJuJbWITVt5jqkgozJA=?d=aU2p5blW_uklcUicQ_nZaeEmhyB6f7xhfJjbXL0FWAgJDhjagymBlc9seCk4qQKPxr_cf-2HynMH-71NB3n8EfsRHa91bkskoQsT8k2WQBH1tNECgmuSydQM7Y8Vmufpky4d2ijdC39Z152WYGLiOKIb06AG8zu6cDoCD876hGthdsj81uu4YTzPFwumtNOhcaQoa5R6RGtav3cq-psk6QcapfAYQ_oQWvfYYlIwlDUJdbA56jht0ilnRECf9eluYH3vfxEWxeZhVLv6zKLxxxhwMgsf7Ei-dEwUbFQtU-59snkae4-96YG0jf0BwskYxGAgr4pAToAat5MAolz4P-Cm9JcVDXo1vQp7MrazBfjO3do3uZ2tHbMUjM3G_wUCE1xARUEhjp1tR9smilQpOJS3rK1OpAA8dFhz2nlKnJzTjyqqVEitL7rnYyl3m0yhl5F2YAHC-alPnB0GKoQPL5LZIheCVW1M27M%3D&u=https%3A%2F%2Fmailarchive.ietf.org%2Farch%2Fbrowse%2Fteep%2F
    
    Group page: https://clicktime.symantec.com/a/1/J-4k6ExKU4iQH_Qo0lVmubxy8-0SEGp6H1wxnq0Tb_o=?d=aU2p5blW_uklcUicQ_nZaeEmhyB6f7xhfJjbXL0FWAgJDhjagymBlc9seCk4qQKPxr_cf-2HynMH-71NB3n8EfsRHa91bkskoQsT8k2WQBH1tNECgmuSydQM7Y8Vmufpky4d2ijdC39Z152WYGLiOKIb06AG8zu6cDoCD876hGthdsj81uu4YTzPFwumtNOhcaQoa5R6RGtav3cq-psk6QcapfAYQ_oQWvfYYlIwlDUJdbA56jht0ilnRECf9eluYH3vfxEWxeZhVLv6zKLxxxhwMgsf7Ei-dEwUbFQtU-59snkae4-96YG0jf0BwskYxGAgr4pAToAat5MAolz4P-Cm9JcVDXo1vQp7MrazBfjO3do3uZ2tHbMUjM3G_wUCE1xARUEhjp1tR9smilQpOJS3rK1OpAA8dFhz2nlKnJzTjyqqVEitL7rnYyl3m0yhl5F2YAHC-alPnB0GKoQPL5LZIheCVW1M27M%3D&u=https%3A%2F%2Fdatatracker.ietf.org%2Fgroup%2Fteep%2F
    
    Charter: https://clicktime.symantec.com/a/1/tnR3SwEMKF1WiNWqiSC3mxWcdslXn_D3fHdAwgNvONM=?d=aU2p5blW_uklcUicQ_nZaeEmhyB6f7xhfJjbXL0FWAgJDhjagymBlc9seCk4qQKPxr_cf-2HynMH-71NB3n8EfsRHa91bkskoQsT8k2WQBH1tNECgmuSydQM7Y8Vmufpky4d2ijdC39Z152WYGLiOKIb06AG8zu6cDoCD876hGthdsj81uu4YTzPFwumtNOhcaQoa5R6RGtav3cq-psk6QcapfAYQ_oQWvfYYlIwlDUJdbA56jht0ilnRECf9eluYH3vfxEWxeZhVLv6zKLxxxhwMgsf7Ei-dEwUbFQtU-59snkae4-96YG0jf0BwskYxGAgr4pAToAat5MAolz4P-Cm9JcVDXo1vQp7MrazBfjO3do3uZ2tHbMUjM3G_wUCE1xARUEhjp1tR9smilQpOJS3rK1OpAA8dFhz2nlKnJzTjyqqVEitL7rnYyl3m0yhl5F2YAHC-alPnB0GKoQPL5LZIheCVW1M27M%3D&u=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fcharter-ietf-teep%2F

    

    

    
    Milestones:

    

    

    _______________________________________________
    TEEP mailing list
    [email-masked]
    https://clicktime.symantec.com/a/1/JpqWQkqWMv0EKROhzz_bCxXCaBB4YUrKNgJfo4vrRL4=?d=aU2p5blW_uklcUicQ_nZaeEmhyB6f7xhfJjbXL0FWAgJDhjagymBlc9seCk4qQKPxr_cf-2HynMH-71NB3n8EfsRHa91bkskoQsT8k2WQBH1tNECgmuSydQM7Y8Vmufpky4d2ijdC39Z152WYGLiOKIb06AG8zu6cDoCD876hGthdsj81uu4YTzPFwumtNOhcaQoa5R6RGtav3cq-psk6QcapfAYQ_oQWvfYYlIwlDUJdbA56jht0ilnRECf9eluYH3vfxEWxeZhVLv6zKLxxxhwMgsf7Ei-dEwUbFQtU-59snkae4-96YG0jf0BwskYxGAgr4pAToAat5MAolz4P-Cm9JcVDXo1vQp7MrazBfjO3do3uZ2tHbMUjM3G_wUCE1xARUEhjp1tR9smilQpOJS3rK1OpAA8dFhz2nlKnJzTjyqqVEitL7rnYyl3m0yhl5F2YAHC-alPnB0GKoQPL5LZIheCVW1M27M%3D&u=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fteep
    IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
    
    _______________________________________________
    TEEP mailing list
    [email-masked]
    https://clicktime.symantec.com/a/1/JpqWQkqWMv0EKROhzz_bCxXCaBB4YUrKNgJfo4vrRL4=?d=aU2p5blW_uklcUicQ_nZaeEmhyB6f7xhfJjbXL0FWAgJDhjagymBlc9seCk4qQKPxr_cf-2HynMH-71NB3n8EfsRHa91bkskoQsT8k2WQBH1tNECgmuSydQM7Y8Vmufpky4d2ijdC39Z152WYGLiOKIb06AG8zu6cDoCD876hGthdsj81uu4YTzPFwumtNOhcaQoa5R6RGtav3cq-psk6QcapfAYQ_oQWvfYYlIwlDUJdbA56jht0ilnRECf9eluYH3vfxEWxeZhVLv6zKLxxxhwMgsf7Ei-dEwUbFQtU-59snkae4-96YG0jf0BwskYxGAgr4pAToAat5MAolz4P-Cm9JcVDXo1vQp7MrazBfjO3do3uZ2tHbMUjM3G_wUCE1xARUEhjp1tR9smilQpOJS3rK1OpAA8dFhz2nlKnJzTjyqqVEitL7rnYyl3m0yhl5F2YAHC-alPnB0GKoQPL5LZIheCVW1M27M%3D&u=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fteep