Subject: [EAT] Real EAT implementations

From: Laurence Lundblade <[email-masked]>
Date: Sat, 6 Oct 2018 21:28:15 +0700

I believe one of the area directors asked who’s going to implement these attestation schemes we standardize.  One answer is Qualcomm’s already commercialized precursor implementation of EAT which is described very briefly in official marketing material on Qualcomm’s web site <https://www.qualcomm.com/solutions/mobile-computing/features/security/mobile-security> as “Hardware Token”. 

LL

---

From: Michael Richardson <[email-masked]>
Date: Sat, 06 Oct 2018 13:30:42 -0400

Laurence Lundblade <[email-masked]> wrote:
    > I believe one of the area directors asked who’s going to implement
    > these attestation schemes we standardize. One answer is Qualcomm’s
    > already commercialized precursor implementation of EAT which is
    > described very briefly in official marketing material on Qualcomm’s
    > web site as “Hardware Token”.

I see this as evidence:
  1) the market doesn't need/want a standard
  2) Qualcomm isn't going to implement our standard, they already have their own.

Now that could be trivially be refuted if we saw clear participation from
qualcomm, but I haven't seen it yet.  But, maybe I missed it.

I await the charter.
So far I haven't seen something that is concrete enough to be useful on its own.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Jeremy O'Donoghue <[email-masked]>
Date: Sat, 6 Oct 2018 22:06:55 +0000

On 6 Oct 2018, at 18:30, Michael Richardson <[email-masked]<mailto:[email-masked]>> wrote:

Laurence Lundblade <[email-masked]<mailto:[email-masked]>> wrote:

I see this as evidence:

OK, so I'll bite on this... in two separate capacities: one based on my employer and the second as Chair of the Trusted Platform Services Committee at GlobalPlatform.

You'll notice that all four names on the EAT draft are or were Qualcomm employees. EAT is definitely of interest to us.

EAT is under serious consideration as the basis of an attestation format for GlobalPlatform Secure Components (i.e. TEE and Secure Element). We see benefit in having the IETF standardise the more generic aspects of an attestation format around EAT with the GlobalPlatform specifics being addressed by GlobalPlatform.

I'm afraid I'm not very familiar with the arcana of chartering at IETF, so much recent discussion has perhaps not registered with me as strongly as it could have.

---
Jeremy O’Donoghue
Engineer, Principal/Manager, Qualcomm Inc.

---

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 7 Oct 2018 11:44:22 +0000

Hi Michael,

Arm has launched the Platform Security Architecture (PSA) at Arm TechCon 2017 with the goal to improve IoT security.
It is a fairly broad effort clustered into three areas, namely an analysis, architecture and implementation phase. For the first phase we provide templates for threat analysis to derive security requirements. For the architecture phase we offer hardware specifications. For the third phase we offer code.

The Linaro foundation has started a project for firmware development on these Cortex M-class devices (called Trusted Firmware M, or TF-M), see https://community.arm.com/iot/b/blog/posts/the-next-step-for-psa-and-a-secure-iot-future. The TF-M is the place where we are implement the EAT token functionality (as part of the attestation API). There are also other APIs, such as crypto and secure storage.
Since the attestation API not only allows an application to access attestation functionality locally on the device but also to expose these attestation tokens to other services there is an interoperability problem. The Qualcomm-developed token format, which re-uses existing IETF technology, showed up at the right time for us and we believe it is a good approach. For this reason we support draft-ietf-mandyam-eat.

The TF-M implementation and the work we do on attestation feels pretty real to me. We hope that many companies implementing IoT products want to make use of the TF-M code as a foundation to make their devices more secure.

Ciao
Hannes

PS: More details about the PSA can be found at https://pages.arm.com/psa-resources.html. If you happen to be in San Jose in the week of 16th - 18th October Arm and its partners will talk about the recent developments around the PSA (and IoT security in general) at Arm TechCon.

-----Original Message-----
From: EAT <[email-masked]> On Behalf Of Michael Richardson
Sent: Saturday, October 6, 2018 7:31 PM
To: [email-masked]; [email-masked]
Subject: Re: [EAT] [Rats] Real EAT implementations

I see this as evidence:

Now that could be trivially be refuted if we saw clear participation from qualcomm, but I haven't seen it yet.  But, maybe I missed it.

I await the charter.

--
Michael Richardson <[email-masked]>, Sandelman Software Works  -= IPv6 IoT consulting =-

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Carl Wallace <[email-masked]>
Date: Sun, 07 Oct 2018 10:11:01 -0400

On 10/6/18, 1:30 PM, "EAT on behalf of Michael Richardson"
<[email-masked] on behalf of [email-masked]> wrote:

>    > these attestation schemes we standardize.

[CW] I work on a product that consumes several different types of
attestations in support of public key certificate issuance to phones and
tablets. We would likely adopt standard formats, verification rules and
bindings to certificate management protocols, where possible. We've had to
roll our own mechanisms to work around lack of standards support in some
cases (but in no case are we the source of an attestation, which may be
the spirit of the question).

>    > One answer is Qualcomm’s

[CW] There are definitely gaps that would benefit from standardization and
some proprietary mechanisms that could be improved by adopting the result
of standards work, if vendors that generate attestations are willing.

>_______________________________________________
>EAT mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/eat

---

From: Suresh Marisetty <[email-masked]>
Date: Mon, 8 Oct 2018 03:15:42 +0000

HI,

Like Jeremy informed in another thread, GlobalPlatform is aligning with these standard claims and working on API definition as well as part of the Trusted Platform Services committee.

In synch up with above, Arm Platform Security Architecture is also aligning with it.

Defining the base claims and standardizing them is a win-win in the IoT space specifically, to reduce market fragmentation and promote interoperability with Cloud Relying Parties/Verifiers.

Thanks
Suresh Marisetty

-----Original Message-----
From: EAT <[email-masked]> On Behalf Of Hannes Tschofenig
Sent: Sunday, October 7, 2018 4:44 AM
To: Michael Richardson <[email-masked]>; [email-masked]; [email-masked]
Subject: Re: [EAT] [Rats] Real EAT implementations

Hi Michael,

Ciao
Hannes

-----Original Message-----
From: EAT <[email-masked]> On Behalf Of Michael Richardson
Sent: Saturday, October 6, 2018 7:31 PM
To: [email-masked]; [email-masked]
Subject: Re: [EAT] [Rats] Real EAT implementations

I see this as evidence:

I await the charter.