pkic / remote-key-attestation Goto Github PK
View Code? Open in Web Editor NEWRemote Key Attestation
License: MIT License
Remote Key Attestation
License: MIT License
Just making you aware of the IETF activities in the area of attestation, which have some crossover involvement with members of the PKIC.
e.g. https://www.ietf.org/archive/id/draft-ietf-lamps-csr-attestation-01.html
CMS/PKCS#7
https://www.i4p.com/documents/Trident_RSS_summary_sheet_200929.pdf
No detailed documentation for key attestation available on-line.
Add information about Entrust nChield to the table
The SmartCard-HSM token supports Key Attestation using CV-Certificate Requests as defined in TR-03110.
Whenever new key pairs (EC or RSA) are generated on a device, the public key is embedded in CV-REQ and signed by the Device Authentication Private Key. The resulting CV-REQ can be processed by most CVC libraries or other SmartCard-HSMs.
Each device has a Device Authentication EC Key Pair that is certified by the Device Issuer CA during production. The Device Issuer CA itself is certified by the SmartCard-HSM Root CA. The Root CA certificate is placed as trust-anchor in the device during production, so that peering SmartCard-HSMs can validate each others public keys.
The key attestation is the basis for P2P ECDH, that is the cryptographic basis for XKEK Key Domains in which key material can migrated between authorized devices.
Seems that Entrust are now offering a key attestation generation and verification functionality.
The attestation bundle format is JSON and the verifier is a Windows/Linux installable tool.
We have received some requests to add a clear, step-by-step procedure or a direct link to the relevant section of the device documentation explaining how to create and verify non-cryptographic key attestations with a specific vendor.
This request stems from the acknowledgment of limited availability of remote (cryptographic) key attestation by vendors.
It's particularly crucial that this procedure meets the code signing certificate requirements of the CA/Browser Forum.
If we would like to facilitate such information it should be emphasized that non-cryptographic mechanisms for key attestation can't be fully relied upon.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.