Subject: Re: [Teep] [EXT] Re: Call for adoption

From: "Wheeler, David M" <[email-masked]>
Date: Wed, 2 May 2018 14:13:45 +0000

Ming,
Can you just confirm that there are NO DIFFERENCES between the last released version and the 06 OTrP document?
If there are differences, can you give a short summary so I know where to look?
Much appreciated,
Dave Wheeler

From: TEEP [mailto:[email-masked]] On Behalf Of Mingliang Pei
Sent: Thursday, April 26, 2018 10:46 AM
To: Nancy Cam-Winget (ncamwing) <[email-masked]>; [email-masked]
Subject: Re: [Teep] [EXT] Re: Call for adoption

Thank you Nancy, Dave and all for your support, comments and suggestions.

Yes, I will rename the draft to “draft-ietf-teep-opentrustprotocol” and resubmit it very soon.

Thanks, again,

Ming

From: TEEP <[email-masked]<mailto:[email-masked]>> on behalf of "Nancy Cam-Winget (ncamwing)" <[email-masked]<mailto:[email-masked]>>
Date: Thursday, April 26, 2018 at 8:58 AM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [EXT] Re: [Teep] Call for adoption

Hearing (or reading) no strong objections, “draft-pei-opentrustprotocol” is adopted by the WG.

A few comments have already been provided that can be addressed in subsequent versions some can also be clarified in the architecture draft.

Ming: when you get a chance, please submit the draft with the name:  draft-ietf-teep-opentrustprotocol

Your chairs, Dave and Nancy

From: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Date: Monday, April 2, 2018 at 11:07 AM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Call for adoption

All,

There was strong interest and consensus at the TEEP f2f IETF 101 meeting in London for adopting
https://datatracker.ietf.org/doc/draft-pei-opentrustprotocol/<https://clicktime.symantec.com/a/1/gRKJSsq7kQhfqIKwz5wHUYr68TvGP5gAqpJNYBP-b7k=?d=8WYzqysvQkd-X_pG-TDgQWMOhCT_hZ1FSVct6-8Ei0YXDodJ-BlC1HRZVDivUH6gtXKkOaBplQ4cm5LXvKuOoc75nlsRDpZ0rTVUq3fI7jVSXjtiB2k5l62ztuPK_5u9S0O3mA7XFXurjMVspCv9uWGRny0TCxWJTwmktVrcQ-LZsoLDB69BN4KytF_Po_2Z2uln01QFKhgSZXUOR-YCo0fpFWZNBDKlXao5KGMKu-LMjD9wwhzQSXXsEgOk-r_0Vzw4CArYfYfPSqkGXkT1bJegLFfBHZZ6RGWMovT3TJ8Z2EohP6RQgIWuG16Z_L_WaaiTJKC75JKHUnWLAF4IObMDfaL4frUNdI7SaFJEk1Nym6ab&u=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-pei-opentrustprotocol%2F>  as a draft protocol.

This is a call for adoption as a working group draft .  If you have any concerns or objections please respond
by April 16th.

Warm regards, Nancy

---

From: Dave Thaler <[email-masked]>
Date: Wed, 2 May 2018 17:13:00 +0000

You can see the diffs at
https://tools.ietf.org/rfcdiff?url1=https://www.ietf.org/archive/id/draft-pei-opentrustprotocol-06.txt&url2=https://tools.ietf.org/id/draft-ietf-teep-opentrustprotocol-00.txt

I see that a number of typos were fixed, but there were no substantial differences.

Dave

From: TEEP <[email-masked]> On Behalf Of Wheeler, David M
Sent: Wednesday, May 2, 2018 7:14 AM
To: Mingliang Pei <[email-masked]>; Nancy Cam-Winget (ncamwing) <[email-masked]>; [email-masked]
Subject: Re: [Teep] [EXT] Re: Call for adoption

Ming,

From: TEEP [mailto:[email-masked]] On Behalf Of Mingliang Pei
Sent: Thursday, April 26, 2018 10:46 AM
To: Nancy Cam-Winget (ncamwing) <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
Subject: Re: [Teep] [EXT] Re: Call for adoption

Thanks, again,

Ming

All,

There was strong interest and consensus at the TEEP f2f IETF 101 meeting in London for adopting
https://datatracker.ietf.org/doc/draft-pei-opentrustprotocol/<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fclicktime.symantec.com%2Fa%2F1%2FgRKJSsq7kQhfqIKwz5wHUYr68TvGP5gAqpJNYBP-b7k%3D%3Fd%3D8WYzqysvQkd-X_pG-TDgQWMOhCT_hZ1FSVct6-8Ei0YXDodJ-BlC1HRZVDivUH6gtXKkOaBplQ4cm5LXvKuOoc75nlsRDpZ0rTVUq3fI7jVSXjtiB2k5l62ztuPK_5u9S0O3mA7XFXurjMVspCv9uWGRny0TCxWJTwmktVrcQ-LZsoLDB69BN4KytF_Po_2Z2uln01QFKhgSZXUOR-YCo0fpFWZNBDKlXao5KGMKu-LMjD9wwhzQSXXsEgOk-r_0Vzw4CArYfYfPSqkGXkT1bJegLFfBHZZ6RGWMovT3TJ8Z2EohP6RQgIWuG16Z_L_WaaiTJKC75JKHUnWLAF4IObMDfaL4frUNdI7SaFJEk1Nym6ab%26u%3Dhttps%253A%252F%252Fdatatracker.ietf.org%252Fdoc%252Fdraft-pei-opentrustprotocol%252F&data=02%7C01%7Cdthaler%40microsoft.com%7C7a6910317f434c0cf7e508d5b036f02f%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C636608672364767599&sdata=4N1Xkn78OMBQeskfI6i%2FOe4R37Hw%2BcOELBqt06w6x%2FY%3D&reserved=0>  as a draft protocol.

Warm regards, Nancy

---

From: Mingliang Pei <[email-masked]>
Date: Wed, 2 May 2018 18:23:00 +0000

Thanks Dave T, that is correct.

Hi Dave W, yes, I can confirm that it is exactly the same version as v06 OTrP except a few typo fixes. The plan is to rename the “adopted” version v06 first to WG named draft, and we work on revision from there with full continuity.

Thanks,

Ming

From: Dave Thaler <[email-masked]>
Date: Wednesday, May 2, 2018 at 10:13 AM
To: "Wheeler, David M" <[email-masked]>, Mingliang Pei <[email-masked]>, "Nancy Cam-Winget (ncamwing)" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: RE: [Teep] [EXT] Re: Call for adoption

You can see the diffs at

Dave

Ming,

Thanks, again,

Ming

All,

Warm regards, Nancy

---

From: Nicolae Paladi <[email-masked]>
Date: Fri, 4 May 2018 11:35:24 +0200

Hello,

I have read through the 06 OTrP document; besides a list of miscellaneous omissions and minor misses (that can be addressed later), several points caught my eye:

1. In §5.2 the acronym “AIK” from  "TEE SP anonymous key (AIK)” reads very similar to the concept of an “Attestation Identity Key”  (e.g. from [1]). 
Is that the purpose? If yes, the key and its role should be introduced, otherwise a different acronym could be used.

2. In §6.3.1 the draft mentions that “It is important to ensure a legitimate OTrP Agent is installed”. 
However, it is not clear what a “legitimate” agent is and how one can ensure that a “legitimate” agent installed.
Given that the agent runs in the REE where the applications are by definition un-trusted (as per 3.1), this paragraph leads to a dead end.
What is the relation between a “legitimate” application and a “trusted” application?

3. §6.3.2 states twice (duplication) that only one OTrP agent is expected. 
However, given that “a user can dynamically download and install an OTrP Agent on demand” (as per §6.3.1), it is unclear what this expectation is based on.
Moreover, the interaction is multiple OTrP agents on the platform is not discussed.

Best regards,
Nicolae

====

[1] Ernie Brickell, Jan Camenisch, and Liqun Chen. 2004. Direct anonymous attestation. In Proceedings of the 11th ACM conference on Computer and communications security (CCS '04). ACM, New York, NY, USA, 132-145. DOI=http://dx.doi.org/10.1145/1030083.1030103

> On 02 May 2018, at 20:23, Mingliang Pei <[email-masked]> wrote:
> 
>  <>From: TEEP [mailto:[email-masked] <mailto:[email-masked]>] On Behalf Of Mingliang Pei
> To: Nancy Cam-Winget (ncamwing) <[email-masked] <mailto:[email-masked]>>; [email-masked] <mailto:[email-masked]>
> From: TEEP <[email-masked] <mailto:[email-masked]>> on behalf of "Nancy Cam-Winget (ncamwing)" <[email-masked] <mailto:[email-masked]>>
> To: "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>
> From: "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>
> To: "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>
> All, <>
> https://datatracker.ietf.org/doc/draft-pei-opentrustprotocol/ <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fclicktime.symantec.com%2Fa%2F1%2FgRKJSsq7kQhfqIKwz5wHUYr68TvGP5gAqpJNYBP-b7k%3D%3Fd%3D8WYzqysvQkd-X_pG-TDgQWMOhCT_hZ1FSVct6-8Ei0YXDodJ-BlC1HRZVDivUH6gtXKkOaBplQ4cm5LXvKuOoc75nlsRDpZ0rTVUq3fI7jVSXjtiB2k5l62ztuPK_5u9S0O3mA7XFXurjMVspCv9uWGRny0TCxWJTwmktVrcQ-LZsoLDB69BN4KytF_Po_2Z2uln01QFKhgSZXUOR-YCo0fpFWZNBDKlXao5KGMKu-LMjD9wwhzQSXXsEgOk-r_0Vzw4CArYfYfPSqkGXkT1bJegLFfBHZZ6RGWMovT3TJ8Z2EohP6RQgIWuG16Z_L_WaaiTJKC75JKHUnWLAF4IObMDfaL4frUNdI7SaFJEk1Nym6ab%26u%3Dhttps%253A%252F%252Fdatatracker.ietf.org%252Fdoc%252Fdraft-pei-opentrustprotocol%252F&data=02%7C01%7Cdthaler%40microsoft.com%7C7a6910317f434c0cf7e508d5b036f02f%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C1%7C636608672364767599&sdata=4N1Xkn78OMBQeskfI6i%2FOe4R37Hw%2BcOELBqt06w6x%2FY%3D&reserved=0>  as a draft protocol.
>  
> _______________________________________________
> TEEP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/teep

---

From: Mingliang Pei <[email-masked]>
Date: Thu, 10 May 2018 02:51:36 +0000

Hi Nicolae,

Thank you very much for your comments. Sorry for delayed reply. Please see my comments inline.

Best,

Ming

From: Nicolae Paladi <[email-masked]>
Date: Friday, May 4, 2018 at 2:35 AM
To: Mingliang Pei <[email-masked]>
Cc: Dave Thaler <[email-masked]>, "Wheeler, David M" <[email-masked]>, "Nancy Cam-Winget (ncamwing)" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [Teep] [EXT] Re: Call for adoption

Hello,

Ming: it is different. The TAM will still know a device’s identity basing on TEE key and we introduced AIK to make the application itself no need to access TEE device key. We were aware of DAA but didn’t make it a requirement to use.

Ming: “trusted” application refers to those running in TEE side. You are right, an OTrP Agent cannot be always trusted. We recommend that it is installed as a “system” app that has better protection than a user installed app. If an OTrP agent applicaton is compromised, it cannot steal anything because data is encrypted end-to-end, and TAM will detect it. One threat is that it may cause Denial-of-service to TA management requests. Thanks for your comment; we can elaborate this in “Security Consideration” section. How do you think?

Ming: the OTrP assumes that only one active TEE is installed in a device, see Section 12 and 7.8 etc. You raised a good point on what if a user downloads multiple OTrP agent. It was expected that one “system” OTrP agent is used that associates with the underlying TEE. Supporting multiple different OTrP agents are out of scope for the spec. The focus is on the “messaging protocol” that are exchanged. How an OTrP agent is installed and interact with TEE are left out for implementations. We will add clarification about this. Thanks again for your questions here.

Best regards,
Nicolae

====

[1] Ernie Brickell, Jan Camenisch, and Liqun Chen. 2004. Direct anonymous attestation. In Proceedings of the 11th ACM conference on Computer and communications security (CCS '04). ACM, New York, NY, USA, 132-145. DOI=http://dx.doi.org/10.1145/1030083.1030103<https://clicktime.symantec.com/a/1/FxLZJM03ASlro3ApjZyFHa5jrFqUjyGpGhjI8XOC1X0=?d=m6C10soKZjsw33Z3WzAqLgXYspcBsudM2nUIfa1o0mmI03HqQ3KmRq1gQ2LCFHBvg6I_OCTwg9HEo-dSm9GWB1bai4z4g8oPYU-p9tvCtkLwnCy4XjNiYWHbl4hDBH1XBYV8wONzxnXr3_pxkjPJv8WkoTMlSt9kJV42Y2m5Y6EcNmMOWivqcLhKm0lFJ44NGD-R9LhdGU01v3MaL4Q2vQLBoHZf9oeauDDsrxmN00kEuGowOuW_wVcXsjWfKOzsR_RAvXEzRIDUUhQn-vVpxQrjYSu1Mfi_s0pTQZEqHMstUlVcOKHfXLRAdqdDiEhKKMxBfiUAe5Kc56UJbDPDC85eOx4MiH5B1iBb3v3X8Itd_-TGNkGS8SbbGdgcn-c%3D&u=http%3A%2F%2Fdx.doi.org%2F10.1145%2F1030083.1030103>

On 02 May 2018, at 20:23, Mingliang Pei <[email-masked]<mailto:[email-masked]>> wrote:

Thanks,

Ming

From: Dave Thaler <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, May 2, 2018 at 10:13 AM
To: "Wheeler, David M" <[email-masked]<mailto:[email-masked]>>, Mingliang Pei <[email-masked]<mailto:[email-masked]>>, "Nancy Cam-Winget (ncamwing)" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: RE: [Teep] [EXT] Re: Call for adoption

You can see the diffs at

Dave

From: TEEP <[email-masked]<mailto:[email-masked]>> On Behalf Of Wheeler, David M
Sent: Wednesday, May 2, 2018 7:14 AM
To: Mingliang Pei <[email-masked]<mailto:[email-masked]>>; Nancy Cam-Winget (ncamwing) <[email-masked]<mailto:[email-masked]>>; [email-masked]<mailto:[email-masked]>
Subject: Re: [Teep] [EXT] Re: Call for adoption

Ming,

Thanks, again,

Ming

All,

Warm regards, Nancy
_______________________________________________
TEEP mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/teep<https://clicktime.symantec.com/a/1/mXucsNPSYG5NsyN9moI8H8Nv5l3RsIzSmWatmV1beas=?d=m6C10soKZjsw33Z3WzAqLgXYspcBsudM2nUIfa1o0mmI03HqQ3KmRq1gQ2LCFHBvg6I_OCTwg9HEo-dSm9GWB1bai4z4g8oPYU-p9tvCtkLwnCy4XjNiYWHbl4hDBH1XBYV8wONzxnXr3_pxkjPJv8WkoTMlSt9kJV42Y2m5Y6EcNmMOWivqcLhKm0lFJ44NGD-R9LhdGU01v3MaL4Q2vQLBoHZf9oeauDDsrxmN00kEuGowOuW_wVcXsjWfKOzsR_RAvXEzRIDUUhQn-vVpxQrjYSu1Mfi_s0pTQZEqHMstUlVcOKHfXLRAdqdDiEhKKMxBfiUAe5Kc56UJbDPDC85eOx4MiH5B1iBb3v3X8Itd_-TGNkGS8SbbGdgcn-c%3D&u=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fteep>

---

From: Nicolae Paladi <[email-masked]>
Date: Tue, 15 May 2018 14:56:58 +0200

Hi Mingliang, 

thank you for the clarifications. Comments and suggestions inline.

> On 10 May 2018, at 04:51, Mingliang Pei <[email-masked]> wrote:
> 
> Hi Nicolae,
>  
> From: Nicolae Paladi <[email-masked] <mailto:[email-masked]>>
> To: Mingliang Pei <[email-masked] <mailto:[email-masked]>>
> Cc: Dave Thaler <[email-masked] <mailto:[email-masked]>>, "Wheeler, David M" <[email-masked] <mailto:[email-masked]>>, "Nancy Cam-Winget (ncamwing)" <[email-masked] <mailto:[email-masked]>>, "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>

Nicolae: I understand; in ANY that case it should be introduced in the acronym list (I assume it is an acronym; would be nice to know what it stands for), and also explained in the text body.

> Ming: “trusted” application refers to those running in TEE side. You are right, an OTrP Agent cannot be always trusted. We recommend that it is installed as a “system” app that has better protectio…

Nicolae: I think discussing the security aspects of the OTrP Agent in the “Security Consideration” section is a good idea. 
I would actually move the sentence “It is important to ensure a legitimate OTrP Agent is installed” also to the “Security Consideration” section - to both motivate this importance, outline the risks and suggest mitigations. 
Otherwise it does not help to underly this importance if earlier in the text the REE was declared untrusted.

> Ming: the OTrP assumes that only one active TEE is installed in a device, see Section 12 and 7.8 etc. You raised a good point on what if a user downloads multiple OTrP agent. It was expected that o…

Nicolae: Sounds good; explicitly marking the scope and the assumptions here will be helpful.

>  
> Best regards,
> Nicolae
>  
> ====
>  
> [1] Ernie Brickell, Jan Camenisch, and Liqun Chen. 2004. Direct anonymous attestation. In Proceedings of the 11th ACM conference on Computer and communications security (CCS '04). ACM, New York, NY, USA, 132-145. DOI=http://dx.doi.org/10.1145/1030083.1030103 <https://clicktime.symantec.com/a/1/FxLZJM03ASlro3ApjZyFHa5jrFqUjyGpGhjI8XOC1X0=?d=m6C10soKZjsw33Z3WzAqLgXYspcBsudM2nUIfa1o0mmI03HqQ3KmRq1gQ2LCFHBvg6I_OCTwg9HEo-dSm9GWB1bai4z4g8oPYU-p9tvCtkLwnCy4XjNiYWHbl4hDBH1XBYV8wONzxnXr3_pxkjPJv8WkoTMlSt9kJV42Y2m5Y6EcNmMOWivqcLhKm0lFJ44NGD-R9LhdGU01v3MaL4Q2vQLBoHZf9oeauDDsrxmN00kEuGowOuW_wVcXsjWfKOzsR_RAvXEzRIDUUhQn-vVpxQrjYSu1Mfi_s0pTQZEqHMstUlVcOKHfXLRAdqdDiEhKKMxBfiUAe5Kc56UJbDPDC85eOx4MiH5B1iBb3v3X8Itd_-TGNkGS8SbbGdgcn-c%3D&u=http%3A%2F%2Fdx.doi.org%2F10.1145%2F1030083.1030103>
>  
>  
>> On 02 May 2018, at 20:23, Mingliang Pei <[email-masked] <mailto:[email-masked]>> wrote:
>>  
>> From: Dave Thaler <[email-masked] <mailto:[email-masked]>>
>> To: "Wheeler, David M" <[email-masked] <mailto:[email-masked]>>, Mingliang Pei <[email-masked] <mailto:[email-masked]>>, "Nancy Cam-Winget (ncamwing)" <[email-masked] <mailto:[email-masked]>>, "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>
>> From: TEEP <[email-masked] <mailto:[email-masked]>> On Behalf Of Wheeler, David M
>> To: Mingliang Pei <[email-masked] <mailto:[email-masked]>>; Nancy Cam-Winget (ncamwing) <[email-masked] <mailto:[email-masked]>>; [email-masked] <mailto:[email-masked]>
>> [email-masked] <mailto:[email-masked]>
>> https://www.ietf.org/mailman/listinfo/teep <https://clicktime.symantec.com/a/1/mXucsNPSYG5NsyN9moI8H8Nv5l3RsIzSmWatmV1beas=?d=m6C10soKZjsw33Z3WzAqLgXYspcBsudM2nUIfa1o0mmI03HqQ3KmRq1gQ2LCFHBvg6I_OCTwg9HEo-dSm9GWB1bai4z4g8oPYU-p9tvCtkLwnCy4XjNiYWHbl4hDBH1XBYV8wONzxnXr3_pxkjPJv8WkoTMlSt9kJV42Y2m5Y6EcNmMOWivqcLhKm0lFJ44NGD-R9LhdGU01v3MaL4Q2vQLBoHZf9oeauDDsrxmN00kEuGowOuW_wVcXsjWfKOzsR_RAvXEzRIDUUhQn-vVpxQrjYSu1Mfi_s0pTQZEqHMstUlVcOKHfXLRAdqdDiEhKKMxBfiUAe5Kc56UJbDPDC85eOx4MiH5B1iBb3v3X8Itd_-TGNkGS8SbbGdgcn-c%3D&u=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fteep>
>  
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/teep <https://www.ietf.org/mailman/listinfo/teep>

---

From: Dave Thaler <[email-masked]>
Date: Tue, 15 May 2018 15:16:06 +0000

>> 2. In §6.3.1 the draft mentions that “It is important to ensure a legitimate OTrP Agent is
>>  installed”. However, it is not clear what a “legitimate” agent is and how one can ensure
>>  that a “legitimate” agent installed.  Given that the agent runs in the REE where the
>> applications are by definition un-trusted (as per 3.1), this paragraph leads to a dead end.
> Ming: “trusted” application refers to those running in TEE side. You are right, an OTrP Agent
> cannot be always trusted. We recommend that it is installed as a “system” app that has better
> protection than a user installed app. If an OTrP agent applicaton is compromised, it cannot steal
> anything because data is encrypted end-to-end, and TAM will detect it. One threat is that it may
> cause Denial-of-service to TA management requests. Thanks for your comment; we can elaborate
> this in “Security Consideration” section. How do you think?

Where or not there is any such thing as a “system” app that has better protection than a “user installed”
app depends on the implementation and may or may not be true.  So this is an implementation detail
and it would be fine to simply mention in Security Considerations that attacks against the network
or the normal world can both still do Denial of Service, so other defenses against DoS are encouraged.
But there’s nothing an OTrP Agent can do that a man-in-the-middle in the network couldn’t do
so I don’t think there’s any reason to be overly restrictive about user-installed apps.

Also, simply installing an OTrP Agent as a system app in no way prevents a separate user-installed
OTrP Agent from also being installed.

>> However, given that “a user can dynamically download and install an OTrP Agent on
>> demand” (as per §6.3.1), it is unclear what this expectation is based on.
> Ming: the OTrP assumes that only one active TEE is installed in a device, see Section 12 and 7.8
> etc. You raised a good point on what if a user downloads multiple OTrP agent. It was expected
> that one “system” OTrP agent is used that associates with the underlying TEE. Supporting multiple
> different OTrP agents are out of scope for the spec. The focus is on the “messaging protocol” that
> are exchanged. How an OTrP agent is installed and interact with TEE are left out for
> implementations. We will add clarification about this. Thanks again for your questions here.

Section A.1.1.2 says “In this example there is a single TEE” which implies it’s only
an example and in other examples there can be multiple.   I don’t think there
should be any assumption in the protocol that there is only one active TEE in
a device.  We might choose to describe the protocol in terms of one TEE per OTrP Agent,
but even though 2 TEEs and 2 OTrP Agents (1:1 correspondence) on a device should still work.

---

From: Jeremy O'Donoghue <[email-masked]>
Date: Wed, 16 May 2018 08:34:45 +0000

[JOD] Dave has a very good point here. It makes sense to distinguish what is “trusted” in the sense of any security certification and what is “authorised” - I think these might be the correct terms.

While the TEE may not “trust” the agent in the formal sense, in practice many REE implementations offer strong mechanisms to identify applications and to assign authorisations and permissions - and these are almost always used in practice. Dave’s suggestion to place this in a section on security considerations makes sense to me.

Best regards
Jeremy

---

From: Mingliang Pei <[email-masked]>
Date: Thu, 24 May 2018 01:10:07 +0000

Thanks Jeremy, Dave and Nicolae for your comments. Please see my comments inline, Ming

From: Jeremy O'Donoghue <[email-masked]>
Date: Wednesday, May 16, 2018 at 1:35 AM
To: Dave Thaler <[email-masked]>
Cc: Mingliang Pei <[email-masked]>, Nicolae Paladi <[email-masked]>, "Nancy Cam-Winget (ncamwing)" <[email-masked]>, "Wheeler, David M" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: [Teep] [EXT] Re: Call for adoption

[MP] Makes sense. I will add this into an item in “security consideration” section.

[MP] We have not found devices as far to have two active “TEEs”, and therefore a simplified assumption when we started the protocol. But I agree that some devices in future might run two TEEs somehow. An one-to-one OTrP agent and TEE correspondence can work without the assumption.

Best regards
Jeremy