Subject: [Teep] Comments on: I-D Action: draft-ietf-teep-architecture-00.txt

From: "Wheeler, David M" <[email-masked]>
Date: Thu, 5 Jul 2018 17:48:23 +0000

Suggest the following modification to the definition of a "Certificate Authority", in section 5.1 page 8, because the current definition does not actually define what a CA is, but only talks about the relationship between the TAM and the device. 

Certification Authority (CA): 
        A Certificate Authority is a trusted entity that verifies the identity and claims
        for other entities and issues signed certificates that communicate verified claims.
        The level of verification performed by any particular CA may vary, and 
        therefore different devices and device manufacturers may choose to trust
        different CAs.
  
        The certificate-based credentials issued by CAs are used for
         authenticating a device, a TAM and an SP. A device embeds a list
         of root certificates from CAs that it trusts, and maintains this list
         as the set of "trust anchors" for the device. A device will validate
        a TAM's certificate against this list of CAs (trust anchors) to determine
        if the TAM can be trusted by the device.
         A TAM will remotely attest a device and verify if the device's Root-of-Trust
         Key is contained within a certificate signed by a CA that the TAM trusts. 

         The CAs that sign the TAM certificate and that sign the device's Root-of-Trust
         certificate do not need to be the same;  different CAs can be chosen by each 
         TAM, and different device CAs can be used by different device manufacturers.
         As long as the TAM trusts the CA that signs the device certificate, and the device
         trusts the CA that signs the TAM certificate, the trust relationship between the
         TAM and the device will be accepted.  

Dave Wheeler

-----Original Message-----
From: TEEP [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Wednesday, July 4, 2018 7:49 AM
To: [email-masked]
Cc: [email-masked]
Subject: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Trusted Execution Environment Provisioning WG of the IETF.

        Title           : Trusted Execution Environment Provisioning (TEEP) Architecture
        Authors         : Mingliang Pei
                          Hannes Tschofenig
                          Andrew Atyeo
                          Dapeng
	Filename        : draft-ietf-teep-architecture-00.txt
	Pages           : 24
	Date            : 2018-07-02

Abstract:
   A Trusted Execution Environment (TEE) was designed to provide a
   hardware-isolation mechanism to separate a regular operating system
   from security- sensitive applications.

   This architecture document motivates the design and standardization
   of a protocol for managing the lifecyle of trusted applications
   running inside a TEE.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-teep-architecture/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-teep-architecture-00
https://datatracker.ietf.org/doc/html/draft-ietf-teep-architecture-00

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
TEEP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/teep

---

From: Mingliang Pei <[email-masked]>
Date: Thu, 5 Jul 2018 18:03:56 +0000

Thank you Dave. I will include the definition of CA to the draft as you suggested.

Ming

On 7/5/18, 10:48 AM, "TEEP on behalf of Wheeler, David M" <[email-masked] on behalf of [email-masked]> wrote:

      

    Dave Wheeler
    
    -----Original Message-----
    From: TEEP [mailto:[email-masked]] On Behalf Of [email-masked]
    Sent: Wednesday, July 4, 2018 7:49 AM
    To: [email-masked]
    Cc: [email-masked]
    Subject: [Teep] I-D Action: draft-ietf-teep-architecture-00.txt

    
    Abstract:

    The IETF datatracker status page for this draft is:
    https://clicktime.symantec.com/a/1/SSwUu25p8n_1F7ec_vDZRBLRYrn2tdp0wYK0uceXvUc=?d=TtgKacgqultOuC4qCgDZPHY6o7VPsyZaIsJI2IlCLa8UZVdRG9YtvOAuIPXEXGjkdjFaGA-KGqyn5UmytUtBWi7AnMSev4Nv2Mxj5nXsLIakJXYi7nqqhUDUWV1bg4ZtEXrSZjWQ-0JrAUlJ-BYVWTOJ8ZLgvlBkK0itcvNQ-L461K_Va3DJQzhhUpibv5yQZS-F_ukdo8I0GLGpB0_h44Iz2bFMfv29PKGXlU9PsmXgyGfXluetTmLsBj5XO5RCUjhi3A-3ut4ZdIbEpZ9cO609XLL2010DgddlIWw6VOKDNlPgVoG5Rnpk5AtGbziBJxL5_WaM5xi9OLgwy7SVUZDKKKqXcYsIusPKTEPfi2E5rEEXwuxDWSAJP-YrRR7ScgV6cKGj-pbG3U6lEjuExZjEsn7qN-CMN6_aG0iWXxIUNJyI3D9tUyi4oN8awfy-&u=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-teep-architecture%2F
    
    There are also htmlized versions available at:
    https://clicktime.symantec.com/a/1/EY_2sMgcI4SC_wUsMcOp3tZu-uGXWS65wBE6bZCeyZY=?d=TtgKacgqultOuC4qCgDZPHY6o7VPsyZaIsJI2IlCLa8UZVdRG9YtvOAuIPXEXGjkdjFaGA-KGqyn5UmytUtBWi7AnMSev4Nv2Mxj5nXsLIakJXYi7nqqhUDUWV1bg4ZtEXrSZjWQ-0JrAUlJ-BYVWTOJ8ZLgvlBkK0itcvNQ-L461K_Va3DJQzhhUpibv5yQZS-F_ukdo8I0GLGpB0_h44Iz2bFMfv29PKGXlU9PsmXgyGfXluetTmLsBj5XO5RCUjhi3A-3ut4ZdIbEpZ9cO609XLL2010DgddlIWw6VOKDNlPgVoG5Rnpk5AtGbziBJxL5_WaM5xi9OLgwy7SVUZDKKKqXcYsIusPKTEPfi2E5rEEXwuxDWSAJP-YrRR7ScgV6cKGj-pbG3U6lEjuExZjEsn7qN-CMN6_aG0iWXxIUNJyI3D9tUyi4oN8awfy-&u=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-ietf-teep-architecture-00
    https://clicktime.symantec.com/a/1/OjMOi5NCla2vpnTypw83XmoY0071TuhZjNeuortxPAk=?d=TtgKacgqultOuC4qCgDZPHY6o7VPsyZaIsJI2IlCLa8UZVdRG9YtvOAuIPXEXGjkdjFaGA-KGqyn5UmytUtBWi7AnMSev4Nv2Mxj5nXsLIakJXYi7nqqhUDUWV1bg4ZtEXrSZjWQ-0JrAUlJ-BYVWTOJ8ZLgvlBkK0itcvNQ-L461K_Va3DJQzhhUpibv5yQZS-F_ukdo8I0GLGpB0_h44Iz2bFMfv29PKGXlU9PsmXgyGfXluetTmLsBj5XO5RCUjhi3A-3ut4ZdIbEpZ9cO609XLL2010DgddlIWw6VOKDNlPgVoG5Rnpk5AtGbziBJxL5_WaM5xi9OLgwy7SVUZDKKKqXcYsIusPKTEPfi2E5rEEXwuxDWSAJP-YrRR7ScgV6cKGj-pbG3U6lEjuExZjEsn7qN-CMN6_aG0iWXxIUNJyI3D9tUyi4oN8awfy-&u=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-teep-architecture-00

    
    _______________________________________________
    TEEP mailing list
    [email-masked]
    https://clicktime.symantec.com/a/1/QbEifk6TU4qqRiOvwguHjLz2R4qwkZLPlXZqPd3nwRM=?d=TtgKacgqultOuC4qCgDZPHY6o7VPsyZaIsJI2IlCLa8UZVdRG9YtvOAuIPXEXGjkdjFaGA-KGqyn5UmytUtBWi7AnMSev4Nv2Mxj5nXsLIakJXYi7nqqhUDUWV1bg4ZtEXrSZjWQ-0JrAUlJ-BYVWTOJ8ZLgvlBkK0itcvNQ-L461K_Va3DJQzhhUpibv5yQZS-F_ukdo8I0GLGpB0_h44Iz2bFMfv29PKGXlU9PsmXgyGfXluetTmLsBj5XO5RCUjhi3A-3ut4ZdIbEpZ9cO609XLL2010DgddlIWw6VOKDNlPgVoG5Rnpk5AtGbziBJxL5_WaM5xi9OLgwy7SVUZDKKKqXcYsIusPKTEPfi2E5rEEXwuxDWSAJP-YrRR7ScgV6cKGj-pbG3U6lEjuExZjEsn7qN-CMN6_aG0iWXxIUNJyI3D9tUyi4oN8awfy-&u=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fteep
    
    _______________________________________________
    TEEP mailing list
    [email-masked]
    https://clicktime.symantec.com/a/1/QbEifk6TU4qqRiOvwguHjLz2R4qwkZLPlXZqPd3nwRM=?d=TtgKacgqultOuC4qCgDZPHY6o7VPsyZaIsJI2IlCLa8UZVdRG9YtvOAuIPXEXGjkdjFaGA-KGqyn5UmytUtBWi7AnMSev4Nv2Mxj5nXsLIakJXYi7nqqhUDUWV1bg4ZtEXrSZjWQ-0JrAUlJ-BYVWTOJ8ZLgvlBkK0itcvNQ-L461K_Va3DJQzhhUpibv5yQZS-F_ukdo8I0GLGpB0_h44Iz2bFMfv29PKGXlU9PsmXgyGfXluetTmLsBj5XO5RCUjhi3A-3ut4ZdIbEpZ9cO609XLL2010DgddlIWw6VOKDNlPgVoG5Rnpk5AtGbziBJxL5_WaM5xi9OLgwy7SVUZDKKKqXcYsIusPKTEPfi2E5rEEXwuxDWSAJP-YrRR7ScgV6cKGj-pbG3U6lEjuExZjEsn7qN-CMN6_aG0iWXxIUNJyI3D9tUyi4oN8awfy-&u=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fteep