Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

What should tee "name" field contain? #10

Open
dthaler opened this issue Mar 24, 2019 · 0 comments
Open

What should tee "name" field contain? #10

dthaler opened this issue Mar 24, 2019 · 0 comments

Comments

@dthaler
Copy link
Collaborator

dthaler commented Mar 24, 2019

The spec is silent on what the purpose of this field is, what it should contain, and who defines the value to put in it. The example in the spec just has the value "Primary TEE", which implies it's an arbitrary string. But that would probably be broken since if there's two TEEs from different vendors and they choose the same string, then you get a collision.

Is it supposed to be a type like "Intel SGX" or "OP-TEE"?
Is it supposed to be a instance name like a hostname, or a guid, that is different per device?

In addition, the TEE cert can have claims embedded in certificate extensions, and so it's unclear why a separate name is needed at all, rather than it being inside the cert where it can be created by and used by other standard attestation mechanisms.

Another implementer mentioned the field is ignored and just has dummy values in their implementation.

If there is some reason a unique value per manufacturer (e.g., "Intel SGX" vs "OP-TEE" etc) is needed, do we need an IANA registry? Or can we use a reverse DNS name ("com.intel.sgx", "org.op-tee", etc.)?

Or should the field be deleted?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant