Attested - Revision history

Tom: /* Context */

2022-08-30T18:53:09Z

‎Context

2022-08-30T18:50:37Z

‎Other internal and external links

2020-10-16T21:53:28Z

‎Problems

2019-11-02T03:46:50Z

‎Other internal and external links

2018-09-20T18:58:08Z

‎Context

2018-09-20T18:57:02Z

‎Context

2018-09-20T18:55:52Z

‎Context

2018-09-19T20:50:24Z

‎Context

2018-09-01T01:42:30Z

‎Solution

2018-09-01T01:41:38Z

‎Solution

@@ Line 4: / Line 4: @@
 ==Context==
-*The Context in which an [[Attested|Attestation]] of [[Security]] applies is typically during the [[Validated|Validation]] of the security protection provided to [[User]] secrets (such as [[Credential]]s) on a [[User Device]].
+*The Context in which an [[Attestation]] of [[Security]] applies is typically during the [[Validated|Validation]] of the security protection provided to [[User]] secrets (such as [[Credential]]s) on a [[User Device]].
-*NIST 800-63-3 defines an [[Attested|Attestation]] as information conveyed to the verifier regarding a directly-connected authenticator or the endpoint involved in an authentication operation. Information conveyed by attestation MAY include, but is not limited to:
+*NIST 800-63-3 defines an [[Attestation]] as information conveyed to the verifier regarding a directly-connected authenticator or the endpoint involved in an authentication operation. Information conveyed by attestation MAY include, but is not limited to:
 #The provenance (e.g., manufacturer or supplier certification), health, and integrity of the authenticator and endpoint.
 #Security features of the authenticator.

@@ Line 29: / Line 29: @@
 # Synonyms include: [[Assurance|Assured]] [[Corroborated]] [[Validated]].
-[[Category:Glossary]]
+[[Category: Glossary]]
-[[Category:Assurance]]
+[[Category: Attestation]]

@@ Line 14: / Line 14: @@
 * When a secure operation is performed at a user location, the packet returned from that [[User Device]] needs to be trusted by the [[Site]] that receives it.
 * The signing key for that packet from a [[User Device]] will have a certificate that binds that signing key to a particular device.
-* If the device reports a serial number, or (equivalently) a public key that is unique that that device, that can be used as a tracking number for the owner of the device.
+* If the device reports a serial number, or (equivalently) a public key that is unique that that device, that can be used as a [[User Tracking|tracking]] number for the owner of the device.
 * In 1999 Intel started to ship Pentium Processors with a serial number that created huge public outcry about the privacy implications. They backtracked a lot from their original assertions about security an privacy with a Q&A for their OEMs to address the issues.<ref>Andrew Thomas, ''Intel Processor Serial Number Q&A for OEMs.'' (2000-05-04) https://www.theregister.co.uk/2000/05/04/intel_processor_serial_number_q/</ref> No company has tried putting a serial number in processors since then.

@@ Line 5: / Line 5: @@
 ==Context==
 *The Context in which an [[Attested|Attestation]] of [[Security]] applies is typically during the [[Validated|Validation]] of the security protection provided to [[User]] secrets (such as [[Credential]]s) on a [[User Device]].
-*NIST 800-63-3 defines an attestation as information conveyed to the verifier regarding a directly-connected authenticator or the endpoint involved in an authentication operation. Information conveyed by attestation MAY include, but is not limited to:
+*NIST 800-63-3 defines an [[Attested|Attestation]] as information conveyed to the verifier regarding a directly-connected authenticator or the endpoint involved in an authentication operation. Information conveyed by attestation MAY include, but is not limited to:
 #The provenance (e.g., manufacturer or supplier certification), health, and integrity of the authenticator and endpoint.
 #Security features of the authenticator.

@@ Line 6: / Line 6: @@
 *The Context in which an [[Attested|Attestation]] of [[Security]] applies is typically during the [[Validated|Validation]] of the security protection provided to [[User]] secrets (such as [[Credential]]s) on a [[User Device]].
 *.2.4 Attestation
-An attestation is information conveyed to the verifier regarding a directly-connected authenticator or the endpoint involved in an authentication operation. Information conveyed by attestation MAY include, but is not limited to:
+*NIST 800-63-3 defines an attestation as information conveyed to the verifier regarding a directly-connected authenticator or the endpoint involved in an authentication operation. Information conveyed by attestation MAY include, but is not limited to:
+#The provenance (e.g., manufacturer or supplier certification), health, and integrity of the authenticator and endpoint.
-The provenance (e.g., manufacturer or supplier certification), health, and integrity of the authenticator and endpoint.
+#Security features of the authenticator.
-Security features of the authenticator.
+#Security and performance characteristics of biometric sensor(s).
-Security and performance characteristics of biometric sensor(s).
+#Sensor modality.
 ==Problems==

@@ Line 15: / Line 15: @@
 * The certificate for the signing key from the [[User Device]], and potentially the configuration information from the device, will need to be [[Attested]] by some [[Trusted Third Party]].
 * It is recommended that a large number (ca 100,000) devices be equipped with the same public key to avoid privacy concerns.<ref name='attestation'>FIDO TechNotes, ''The Truth about Attestation.'' (2018-07-19) https://fidoalliance.org/fido-technotes-the-truth-about-attestation/</ref> Then the public key is basically the [[Identifier]] for the category of [[User Device]].
-* Attestation can be complex for programmable computers, or simple for one function [[User Device]]s like [[Security Token]]s.
+* Attestation can be complex for programmable computers with a [[TPM]], or simple for one function [[User Device]]s like [[Security Token]]s.
 * An example of a single attestation program with associated metadata is described in the FIDO web site<ref name='attestation' />.
 * When a simple certificate is used, it typically is accompanied by a metadata statement, an example is [https://developers.yubico.com/U2F/yubico-metadata.json this one at Yubico].