Subject: Re: [Rats] Android comments on EAT draft - platform/device/component identifiers

From: "Smith, Ned" <[email-masked]>
Date: Tue, 21 May 2019 17:53:51 +0000

Given keys, secrets and data can exist in different environments within a platform and different environments may have differing protection properties it makes sense to describe claims about endpoints in terms of components even though it is likely one component will be primarily regarded as the environment containing a key that is used to identify the “platform”.

How the identifier is constructed doesn’t necessarily need to be specified in the draft so long as the semantics of component disambiguation are met.

Verifiers need to be able to distinguish between components and correctly identify the component that best represents the platform’s identity (and associated private key).  Onboarding and local certification steps can be used to construct the certificate and policy the verifier trusts/uses to evaluate the attested identity.

OEMID, HW Model, HW Version are helpful, but COMPONENT ID / COMPONENT version are also needed to achieve the above degree of disambiguation. Nevertheless, this is prescribing how to construct the identifier – which ultimately should be opaque to the verifier so long as it correctly disambiguates the more trustworthy environment from less trustworthy environments on the same platform.

-Ned

On 5/20/19, 1:51 AM, "RATS on behalf of Jeremy O'Donoghue" <[email-masked]<mailto:[email-masked]> on behalf of [email-masked]<mailto:[email-masked]>> wrote:

On 18 May 2019, at 00:19, Laurence Lundblade <[email-masked]<mailto:[email-masked]>> wrote:

CAUTION: This email originated from outside of the organization.

On May 17, 2019, at 4:21 AM, Jeremy O'Donoghue <[email-masked]<mailto:[email-masked]>> wrote:

Today the "platform" is a unique identifier, normally chosen by the manufacturer, that identifies the hardware and any software relevant to the Target of Evaluation described in a Security Target document - in GlobalPlatform terms this is the TEE or SE, but it is really dependent on the chosen Protection Profile.

There is nothing inherently preventing this from being an entire device although there are, to my knowledge, few certifications that operate at the device level. I do expect this to change.

Can you give some examples?

I will see if I can get some real examples - may take a week or so.

Is a platform identifier unique by being a 128-bit random number, or it is a combination of OEM ID, HW and SW versions?

It is a string. It is something like a combination of OEM ID, HW and SW versions. It is not intended to be cryptographically unique.

The platform identifier in DLOA is only trustworthy if you have first verified the entity to which it applies.

How does it relate to OEM ID, HW Version and SW Version?

As far as I am aware, it is chosen by the platform vendor as a mechanism to uniquely identify the combination of the above that was certified. It probably could be a concatenation of the above, but I believe it is generally shorter for convenience. Best way to describe it is as a hardware and meta-build identifier. Some strong identifying an exact HW platform and some combination of SW images.

Jeremy

LL