A User Centric Security Model for Tamper-Resistant Devices

6.4 Secure and Trusted Channel Protocol Smart Card
The SP veries the U Cre and if the user is authenticated then the SP will proceed with the
protocol. Otherwise, it terminates after a limited number of user authentication retries.
Subsequently, it will verify whether the user (owner) identity referred in the CertS U is
the identity of an authorised and authenticated user. If so, then the SP will verify the
signature. Furthermore, the U Cre will provide the SP with an assurance that the user is
cryptographically bound with the smart card (i.e. has the ownership of the smart card).
6.4 Secure and Trusted Channel Protocol Smart Card
In this section, STCP SC is described along with the rejection messages. Before we provide
a description of the STCP SC , a point to consider is that we adopt the protocol prerequisites
discussed in section 6.3.1 and 4.7.1 with the exception of PPR-8, and PPR-9. The STCP SC
does not require PPR-9. However, if an SP needs to authenticate a user, the SP can
implement the user authentication into their application and execute once the application
is installed and active on the smart card. Based on this user authentication, the SP
can then personalise the application with respective user's data. Furthermore, as the SC
initiates the protocol a connection is not necessary between the SC and SP before the SC
sends the rst message as required by the PPR-10.
6.4.1 Protocol Description
In this protocol, an SC takes the initiator's role, with the respective SP as a responder.
The protocol details and a description of the messages involved are presented below:
STCP SC -1. SC : cm = f NSC (g r SC
||N SC )
SC → SP : cm||SC Sup
An SC generates a Die-Hellman exponential (g r SC ) and a random number (NSC ). Subsequently,
it generates the MAC of the g r SC
||N SC using the generated random number as
the MAC key. The reason for generating the MAC and sending it instead of the random
number and Die-Hellman exponential is to avoid a partial chosen key attack by only providing
a commitment to the SP. The SC Sup lists the Die-Hellman groups, cryptographic
algorithms and attestation mechanism supported by the SC.
On receipt of the rst message, the SP will verify the features listed in the SC Sup . If they
satisfy the SP's requirements then it will proceed with the protocol.
139