A User Centric Security Model for Tamper-Resistant Devices

6.5 Application Acquisition and Contractual Agreement Protocol
requirements listed in section 3.6 as they require a mechanism that is independent of the
administrative authority.
During the STCP ACA , depending upon the relationship between an SP and the administrative
authority of a smart card, the appropriate chain of certicate will be used. Therefore,
if the SP is not an associate of the administrative authority then the certicate chain (chain
1 in gure 6.1) with the CC certication body as a root will be used; otherwise, chain 2 of
the gure 6.1 will be used.
6.5.2 Protocol Prerequisites
In this section, we extend the protocol prerequisites for the STCP ACA
discussed in section 6.3.1 and 4.7.1.
from the ones
PPR-11 Administrative Authority Registration: The smart card is registered with an administrative
authority.
PPR-12 Long Term Keys: Both the smart card and the associated administrative authority
share long-term encryption and MAC keys. These keys are generated at the time
of the smart card's registration with an administrative authority.
PPR-13 List of Syndicated Members: When a card registers with an administrative authority,
the authority may provide the smart card two lists: a list of subscription
charges and a list of associated SPs. The rst list contains details on how the
user will be charged on installation of the individual applications. For example,
charging mechanisms can either be based on xed charges per installation or according
to the size of the application. The associated SPs list includes the details
of individual SPs that are associated with the administrative authority. If a user
requests installation of any of these applications, the installation goes through the
administrative authority and user may not be charged.
6.5.3 Protocol Description
In the STCP ACA , an SP takes the initiator's role so it can be considered as an extension
of the STCP SP . The protocol details and message description are as follows:
142