A User Centric Security Model for Tamper-Resistant Devices

6.3 Secure and Trusted Channel Protocol Service Provider
will generate the session keys, verify the MAC and decrypt the message, and then verify
the smart card certicate. The smart card certicate gives the required assurance that
the smart card platform has had a third party evaluation, and the SP will then proceed
with verifying the signature. The assumption here is that if the third party evaluation
has concluded that the smart card is a tamper-resistant device with an eective validation
mechanism, then it will be dicult for a malicious user to obtain the TEM keys. Hence,
in the presence of a tamper-evidence mechanism only a genuine TEM can generate the
correct signature. However, if the SP cannot verify the signature, then the current state
of the SC has been modied and it is dierent to the one for which it was evaluated.
As a next step, the SP ascertains whether it has already issued an application lease to the
stated smart card. If there is an application lease to the SC for the requested application,
the protocol will terminate. Otherwise, the SP will proceed to the next step.
STCP SP -3. SP : hp = h(SP i ||SC i ||g r SP
||g r SC
||N SP ||N SC )
SP : AU SP = Sign SP (SP i ||SC i ||hp||ALP )
SP : mE = ek SC−SP (AU SP ||ADP ||CertS SP )
SP → SC : mE||f mkSC−SP (mE)||SI
The SP will then sign the identities of both the SC and SP along with the ALP and
hp. The hp is similar to the hs but it is generated by the SP and provides the necessary
evidence to the SC that the message is not a replay or mirror message while at the same
time avoiding man-in-the-middle attack. The signed message is appended to the ADP and
SP's certicate.
On receipt, the SC will verify whether it can support the listed requirements in the ALP.
The most important requirement is whether the SC has enough memory space to accommodate
the SP's application. Furthermore, the SC will also check the hp to prevent
man-in-the-middle and replay attacks.
STCP SP -4. SC : AU U = Sign U (SC i ||SP i ||U i ||hp||hs)
SC : mE = ek SC−SP (U Cre ||AU U ||CertS U )
SC → SP : mE||f mkSC−SP (mE)||SI
The SC requests the cardholder to provide the SP's authentication credentials as requested
by the SP in the SP Sup . After the user provides those credentials they are packaged as
U Cre and are concatenated with a signed message (AU U ) containing the identities of the
SC, SP and user along with the hp and hs. The reason behind including the hp and
hs in the signature is to provide a proof, signed by the user's signature key pair, that
she initiated the protocol session. The signed message along with the certicate and the
user's credentials are then encrypted and MACed. The MAC is generated on the encrypted
message.
138