A User Centric Security Model for Tamper-Resistant Devices

7.5 Platform Binding Protocol
The rst message (PBP-1) contains the pseudo identities of individual smart cards (e.g.
SCA and SCB), along with a random number generated by the SCA (N SCA ). In addition,
the SCA will generate a Die-Hellman exponential g r SCA but to prevent a possible partial
key chosen attack (see section 6.2.3) it does not send the g r SCA . Instead, it sends a
commitment that is basically a hash generated on the g r SCA , random number and the
recipient's pseudo identity.
PBP-2. SCB : SCB cm = h(N SCB ||g r SCB||SCA ′ i )
SCB → SCA : SCB ′ i ||SCA′ i ||N SCB||SCB cm ||SCB Sup
In response, the SCB will select a Die-Hellman group that it can support and include
the selection as SCB Sup . The SCB will also generate its commitment (SCB cm ) similar
to the SCA in the rst message, and sends it to the SCA including the SCB Sup . The
commitments are made by both communicating entities and now in subsequent messages
they can send the generated Die-Hellman exponential.
PBP-3. SCA → SCB : g r SCA||SCA ′ i ||SCB′ i ||N SCA||N SCB
SCB : K DH = (g r SCA) r SCB
mod n
SCB : K SCA−SCB = f KDH (N SCA ||N SCB ||0)
SCB : mK SCA−SCB = f KDH (N SCB ||N SCA ||0)
The SCA will send the Die-Hellman exponential to the SCB along with pseudo-identities
and random numbers generated in previous messages.
On receipt, the SCB will generate the Die-Hellman secret (K DH ). The SCB generates
the PBP master keys (eK SCA−SCB and mK SCA−SCB ) that are used to generate session
keys for the current (e.g. k SCA−SCB and mk SCA−SCB ) and all future sessions.
PBP-4. SCB : cfb = h(N SCA ||g r SCB||g r SCA)
SCB : mE = e kSCA−SCB (V R||SCA ′ i ||SCB i||cfb||CertS SCB )
SCB → SCA : g r SCB||N SCB ||mE||f mkSCA−SCB (mE)
In response, the SCB will ask the platform for assurance and validation proof (i.e. V R)
from the SCB. Furthermore, the pseudo identity of the SCA is appended with the true
identity of the SCB along with the commitment hash generated (cfb) by the SCA, Die-
Hellman exponential and cryptographic certicate of the SCB. The entire message, except
for the Die-Hellman Exponential and the generated random number, is encrypted and
MACed using the generated session keys.
On receipt of the message four (PBP-4), the SCA will also generate the Die-Hellman
secret along with session keys similar to the SCB. It will then verify the SCB's cryptographic
certicate. If both smart cards are being evaluated by the same laboratory then
177