Subject: [Teep] Trusted vs untrusted error codes

From: Dave Thaler <[email-masked]>
Date: Thu, 2 Nov 2017 01:13:55 +0000

As promised when I posted my review, I am starting several email threads for discussions on specific technical topics.
This is one of them.

Currently section 8.1.6 of the draft specifies some cases where the TEE responds with errors, and some cases where code
outside of a TEE (in an OTrP Agent) responds with errors.  In the former case, you can have strong trust in the error since
it can be signed by code in the TEE.  In the latter case, you can't have strong trust in it because it was generated outside
the TEE.

That's probably ok, as long as you can distinguish between them and treat "untrusted" errors as simply hints that might
have been spoofed, rather than authoritative.   But ERR_TEE_FAIL for example says it's used in both cases.

I'd instead recommend that there be separate error code ranges for trusted vs untrusted errors so they can be treated
differently, even for unrecognized errors (for future compatibility).

The security association should terminate inside the TEE, so that the OTrP Agent outside the TEE is not part of it,
it's just a message router.   In that sense, OTrP errors are much like ICMP errors, where they might come from an intermediary
or from an authoritative endpoint.   So I'd like to not repeat the same mistakes as ICMP made.

Dave

From: Dave Thaler
Sent: Saturday, September 23, 2017 12:24 PM
To: [email-masked]' <[email-masked]>
Subject: Review of draft-pei-opentrustprotocol-04

I've finally made it through a detailed review of draft-pei-opentrustprotocol-04 and my marked up copy is at
https://www.microsoft.com/en-us/research/wp-content/uploads/2017/05/draft-pei-opentrustprotocol-04.pdf

I have lots of editorial fixes throughout, and a number of technical comments/questions/issues.

I'll start separate email threads for some of them over the next several days.

Dave