Subject: [Teep] Lethal combination: Attested Session Keys + Canonicalization

From: Anders Rundgren <[email-masked]>
Date: Wed, 27 Mar 2019 12:07:19 +0100

Pardon for spamming you, I know that you already have the TEEP architecture more or less in place...

I just wanted to show how nice a security protocol can be if you combine attested session keys and canonicalization:
https://cyberphone.github.io/doc/security/keygen2.html#Sample_Run

In this particular case there were other things also requiring such an arrangement including user interaction in the middle of the protocol.

"Rolling MACs" and protected API was directly derived from TCG.

Anders