A User Centric Security Model for Tamper-Resistant Devices

A.6 Trusted Transport Layer Protocol (T2LS) Protocol
A.6 Trusted Transport Layer Protocol (T2LS) Protocol
In this thesis, the T2LS protocol described by Gasmi et al. [165] is used that is described
in this section. The messages listed below are on top of the existing TLS protocol that we
do not detail in this section.
T2LS-1. SC → SP : N SC ||CertS SCbind ||CertS SCAIK
The SC initiates the protocol by sending a random number (N SC ) along with associated
TPM's certicates (e.g. CertS SCbind and CertS SCAIK ). The TPM is part of the computing
platform that the SC is using to connect to the SP. This message initiates the TLS
protocol, the SC appends the ClientHello[ciphersuites,hell_ext_list,nonce]
In response, the SP sends the ServerHello[ciphersuites,hell_ext_list,nonce], followed
by key exchange message and completion of security parameter negotiations between
the SP and SC.
T2LS-2. SC → SP : zV SP (SessionKey SC ||CDS SC ||N SP )
The SC will verify the SP's TPM certicates (e.g. CertS SP bind
and CertS SP AIK
). The
SC encrypts its generated session key along with conguration of TPM and TLS protocol
in CDS SC . The public encryption key of the SP is used to encrypt the message.
The SP decrypts the message and validates the CDS SC and the received random number
T2LS-3. SP → SC : zV SC (SessionKey SP ||CDS SP ||N SC )
The SP generates an attestation blob similar to the one generated by the SC in previous
message. On receipt of message three, the SC will verify the CDS SP and N SC .
The trust in the T2LS comes from the values of CDS and verication of the CDS values
by the communicating entities. If the CDS value of a client is satisfactory to the server,
then it can trust the state of the client, and vice versa.
Key Generation.
SC & SP : ms = P RF (N SC ||N SP ||SessionKey SC ||SessionKey SP )
SC & SP : k SC−SP = P RF (ms||CDS SC ||SDS SP )
On receipt of message three, both the SC and SP will proceed with generating the session
key k SC−SP . The notation of P RF listed above refers to the pseudorandom number
generator used by the SC and SP to generate the keys.
A.7 Secure Channel Protocol - 81 (SCP81) Protocol
The GlobalPlatform specication for the SCP81 [169] do not change the message structure
of the TLS protocol [100]. They provide a structure of how a smart card and a remote
administrator authority can use the TLS protocol for remote management of the smart
card contents. In this section, we suce by describing the TLS protocol, which is also
useful to the T2LS protocol as the messages discussed in section A.6 are ones that modify
236