Hardware backed attestation in TLS
summary
Integrates hardware-backed remote attestation as a native authentication mechanism inside TLS 1.3, carrying attestation credentials in the certificate and extension messages and running verification in the handshake free flights. Prototype builds an end-to-end stack using parsec to gather evidence, mbedTLS for the TLS stack, and Verizon as the verifier, anchored to DPM 2.0 and PSA crypto APIs. Open-source, containerized proof-of-concept demonstrates workable authentication, with planned formal verification and mitigations against credential relay/splicing.
AI-written summary · about
chapters (5)
- 0:00Introduction
- 0:41Theory behind attestation
- 7:06TLS and authentication
- 14:06Practical prototype
- 22:39Wrap-up and Q&A
related talks
30mTaming Attestation for the Cloud Native World with Parsec
16mSeparate but Together: Integrating Remote Attestation into TLS
59mLayered Attestation of a Cross-Domain System
29mA Simple Protocol for Remote Attestation of System Integrity
29mRemote Attestation of IoT devices using a discrete TPM 2.0
01h 13mTutorial: Complete Platform Attestation: Remotely Verifying the Authenticity and Integrity of your Platform’s Hardware, Firmware, and Software
42mTPM based attestation - how can we use it for good?
19mBoF: Simple Remote Attestation with Secure & Attested Communication Channels