search

pkic / remote-key-attestation

Remote Key Attestation
MIT License
26 stars 5 forks source link

Non-Cryptographic Key Attestation #9

Open vanbroup opened 7 months ago

vanbroup commented 7 months ago

We have received some requests to add a clear, step-by-step procedure or a direct link to the relevant section of the device documentation explaining how to create and verify non-cryptographic key attestations with a specific vendor.

This request stems from the acknowledgment of limited availability of remote (cryptographic) key attestation by vendors.

It's particularly crucial that this procedure meets the code signing certificate requirements of the CA/Browser Forum.

If we would like to facilitate such information it should be emphasized that non-cryptographic mechanisms for key attestation can't be fully relied upon.

primetomas commented 6 months ago

Specific to CA/B Forum requirements I know these, but they build on cryptographic capabilities: https://support.fortanix.com/hc/en-us/articles/18924491083028-Using-Fortanix-DSM-for-Verifying-Key-Attestation-Statements https://data-protection-updates.gemalto.com/2020/04/15/public-key-confirmation-meeting-ca-browser-forum-standards-with-luna-and-luna-cloud-hsms/

Adding these to the table.

primetomas commented 4 months ago

@vanbroup : I find these on Entrust web: https://www.entrust.com/knowledgebase/ssl/code-signing-private-key-protection-requirements-for-cloud-hsm-providers If we want to add examples of non-cryptographic key attestation, could Entrust contribute?