Subject: [Teep] Overcoming other limitations in the TEE landscape

From: Anders Rundgren <[email-masked]>
Date: Sun, 4 Jun 2017 08:18:31 +0200

F.Y.I.

We all agree that TEEs are great, right?

However, TEEs are no better than the environments they are supposed to be used in:
https://www.linkedin.com/pulse/motives-better-qr-anders-rundgren
(you don't need a LinkedIn account to read this short writeup)

Anders

---

From: Brian Witten <[email-masked]>
Date: Mon, 5 Jun 2017 13:21:00 +0000

Thanks!  IMHO active RFID (keys & crypto embedded in the tag, executed in the tag for strong authentication, private keys never leaving the tag, several schemes leverage PKI like this embedded in RFID tags with just enough crypto/computing power) ... active RFID (like that) helps break past the "easily copied" challenges of QR codes, mag-stripe credit cards, SSN's and the like, and does so at a price not too far from QR stickers/physical-printing.  However, the TEE in a mobile device (and TEE in IOT devices such as smart-glasses, badge-scanners, and nearly anything else) with more compute than an RFID "tag" helps add similar "hardware backed" security for such devices who might be not only interrogating such tags, but might also be collaborating with such tags in talking with cloud based services.

At least that's my view, but I'm very open to others -

________________________________
From: TEEP <[email-masked]> on behalf of Anders Rundgren <[email-masked]>
Sent: Saturday, June 3, 2017 11:18:31 PM
To: [email-masked]
Subject: [EXT] [Teep] Overcoming other limitations in the TEE landscape

F.Y.I.

Anders

_______________________________________________
TEEP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/teep

---

From: Anders Rundgren <[email-masked]>
Date: Tue, 6 Jun 2017 07:36:54 +0200

On 2017-06-05 15:21, Brian Witten wrote:

> Thanks!  IMHO active RFID (keys & crypto embedded in the tag, executed
> in the tag for strong authentication, private keys never leaving the tag, 
> several schemes leverage PKI like this embedded in RFID tags with just
> enough crypto/computing power) ... active RFID (like that) helps break past
> the "easily copied" challenges of QR codes, mag-stripe credit cards, SSN's 
> and the like, and does so at a price not too far from QR stickers/physical-printing. 
> However, the TEE in a mobile device (and TEE in IOT devices such as smart-glasses,
> badge-scanners, and nearly anything else) with more compute than an RFID "tag" 
> helps add similar "hardware backed" security for such devices who might be not
> only interrogating such tags, but might also be collaborating with such tags in
> talking with cloud based services.

Thanx Brian,

I don't fully grasp what you are writing but AFAIK only FIDO alliance
products address NFC support over the Web.  However, for people using this
dreadful old technology known as PKI there's nothing (standards-wise),
which is why I have created an "issue" for such a development:

https://github.com/w3c/web-nfc/issues/128

This is not (at all) only about security but about creating a better
user experience for using TEE-powered phones together with a PC/Browser.

Cheers,
Anders

> ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
> *From:* TEEP <[email-masked]> on behalf of Anders Rundgren <[email-masked]>
> *Sent:* Saturday, June 3, 2017 11:18:31 PM
> *To:* [email-masked]
> *Subject:* [EXT] [Teep] Overcoming other limitations in the TEE landscape
> F.Y.I.
>