Jan Thies: Remote Attestation

Communicating devices have little means to judge the software running at the remote peers. Remote attestation is a counter approach: a device sends evidence about its own state in a cryptographically protected form. In combination with a trusted execution environment as the root of trust, a full compromise of the operating system may not forge this evidence.

RIOT OS does not yet support remote attestation. In this talk, we present a hardware-agnostic attestation module for RIOT, built along the architecture of RFC 9334. Depending on the target board RIOT, the module selects an appropriate backend at compile time. On the nRF9160, for example, the attesting environment lives in the TrustZone-M secure world, which holds the attestation key and measures the non-secure firmware image at boot. TurstZone-M protects the key and the code that produces the attestation claims. On boards without TrustZone, the module rests either on alternative trusted enclaves or falls back to a weaker, software-confined scheme, in which key and measurement share the address space with the application.

Open questions remain. It is not yet clear how the code producing the evidence can itself be attested rather than assumed trustworthy, nor how a device can attest to the state it is actually running rather than merely its image on booted. We want to discuss options and future directions in this seminar.