Role of Client Application

[hannestschofenig]

In most discussions the TEEP messaging interaction has been described as a protocol that runs between the TAM and the TEE with a relay (Agent) that passed messages back and forth.

However, the OTrP specification also gives a role to the Client Application not only in the sense of triggering the interaction (since the TEE itself cannot communicate to the outside world on its own) but via the GetTAInformation call. The GetTAInformation call described in Section 6.4.2 of https://tools.ietf.org/html/draft-ietf-teep-opentrustprotocol-01 allows a Client Application to query a TEE about a previously installed TA without requiring the interaction with a TAM.

In order for this to work the Client Application has to known the TA's identifier and also the AIK public key.

The Client App has to obtain this information somehow.

The important implication of allowing the Client App to participate in the TEEP message exchange is that the protocol interaction becomes a three party interaction rather than a two party protocol. There is also the need to consider the encoding of the protocol messages so that they are friendly for app developers since the Client App needs to deal with the TEEP messaging exchanges.

As this functionality appears to be an optimization it would be good to know how much is actually gained by this optimization.

[hannestschofenig]

I pointed this out in my new review of the security domain, see issue #7

[dthaler]

Discussion among editors: APIs between client app and TEEs should be in arch doc, not in OTrP spec per se, which should just focus on the actual OTrP messages themselves, which go between TAM and OTrP Agent (not the client app per se).

Arch doc can have a list of Broker/Agent apis, and leave details to the broker (transport spec), and agent (protocol spec).

[dthaler]

List of OTrP broker -> OTrP Agent apis currently in the transport spec: RequestTA, ProcessOTrPMessage, RequestPolicyCheck, ProcessError.
List of TAM transport -> TAM OTrP implementation apis currently in the transport spec: ProcessConnect, ProcessOTrPMessage.

[dthaler]

@ncamwing this issue is ready to be closed