pkic / remote-key-attestation Goto Github PK

Just making you aware of the IETF activities in the area of attestation, which have some crossover involvement with members of the PKIC.

e.g. https://www.ietf.org/archive/id/draft-ietf-lamps-csr-attestation-01.html

CMS/PKCS#7
https://www.i4p.com/documents/Trident_RSS_summary_sheet_200929.pdf
No detailed documentation for key attestation available on-line.

https://developer.android.com/training/articles/security-key-attestation

Add information about Entrust nChield to the table

The SmartCard-HSM token supports Key Attestation using CV-Certificate Requests as defined in TR-03110.

Whenever new key pairs (EC or RSA) are generated on a device, the public key is embedded in CV-REQ and signed by the Device Authentication Private Key. The resulting CV-REQ can be processed by most CVC libraries or other SmartCard-HSMs.

Each device has a Device Authentication EC Key Pair that is certified by the Device Issuer CA during production. The Device Issuer CA itself is certified by the SmartCard-HSM Root CA. The Root CA certificate is placed as trust-anchor in the device during production, so that peering SmartCard-HSMs can validate each others public keys.

The key attestation is the basis for P2P ECDH, that is the cryptographic basis for XKEK Key Domains in which key material can migrated between authorized devices.

Seems that Entrust are now offering a key attestation generation and verification functionality.

The attestation bundle format is JSON and the verifier is a Windows/Linux installable tool.

We have received some requests to add a clear, step-by-step procedure or a direct link to the relevant section of the device documentation explaining how to create and verify non-cryptographic key attestations with a specific vendor.

This request stems from the acknowledgment of limited availability of remote (cryptographic) key attestation by vendors.

It's particularly crucial that this procedure meets the code signing certificate requirements of the CA/Browser Forum.

If we would like to facilitate such information it should be emphasized that non-cryptographic mechanisms for key attestation can't be fully relied upon.