search

xaptum / ecdaa

A C implementation of elliptic-curve-based Direct Anonymous Attestation (DAA) signatures. Created to support the Xaptum Edge Network Fabric, an IoT Network Solution.
https://www.xaptum.com
Apache License 2.0
45 stars 8 forks source link

Limit the number of times someone can join. #143

Closed akakou closed 2 years ago

akakou commented 2 years ago

To limit the number of times someone access with basename mode DAA, we have to limit the number of times someone can join. (Because someone who has many credentials, can generate many different nym with the same basename.)

So could you tell me how to limit the number of times someone can join, with this ecdaa library?

akakou commented 2 years ago

Maybe the FIDO's specification is useful to solve it, but I have no concrete idea to solve it.

zanebeckwith commented 2 years ago

Hi @akakou, sorry for the response delay

I'm afraid I don't follow your question.

someone who has many credentials, can generate many different nym with the same basename

It seems that keeping someone from using multiple credentials is outside the scope of this library.

Ensuring that a particular physical device is only allowed to receive a single credential is typically handled by having the joiner send some unique device identifier (e.g. an X509 certificate signed by the manufacturer). Is that what you're looking for?

akakou commented 2 years ago

Thank you for replying!

Ensuring that a particular physical device is only allowed to receive a single credential is typically handled by having the joiner send some unique device identifier (e.g., an X509 certificate signed by the manufacturer).

That is true. As you said, it's might outside the scope of this library.

But if you don’t mind, could you tell me whether the credentials of the library are compatible with activating credentials, or not?

Activate credential is used for the join protocol on FIDO. https://fidoalliance.org/specs/fido-uaf-v1.1-ps-20170202/fido-ecdaa-algorithm-v1.1-ps-20170202.html#ecdaa-join-split-between-tpm-and-asm

zanebeckwith commented 2 years ago

Sorry again for the long delay.

I haven't tested it, but yes I believe this library should properly implement the FIDO Join. Steps 1.3.1 and 1.3.2 (creating the initial keypair) in your link would have to be implemented yourself; you can take a look at this test utility and this doc for pointers.

However, as mentioned in this doc, the TPM signatures of this project use TPM2_Sign rather than TPM2_Certify. So, I don't think you would be able to use this library for signing using credentials created as above.

Does this help?

akakou commented 2 years ago

Sorry for the long delay. Thank you so much!

zanebeckwith commented 2 years ago

No problem! Good luck!