Apparently, the TPM is not used for platform attestation but only as random number generator, for RSA en- and decryption and signature creation and verification.
We demonstrate a detailed design and prototype implementation of AAoT, a lightweight and practical mechanism for Attestation and Authentication of Things, that can provide software integrity, mutual authentication and tamper-proof feature for smart embedded devices.
"The assessment will be done under the SSAE 18 standard (Statement of Standards for Attestation Engagements).
Statement on Standards for Attestation Engagements No. 16.
The standard was superseded by SSAE16 (www.ssae16.com), which stands for Statement on Standards for Attestation Engagements No. 16.
The authors again claim to use the EK for attestation which is not permitted by the TPM specification.
We refer applications that run within the operating environment of portable trusted device and need to be measured for attestation purpose to as native applications.
Examples include: the ISO/IEC 27000 series, which are international information security management standards [29]; "Statement on Standards for Attestation Engagements No. 16" (SSAE 16) [30], which is an attestation standard for service organizations, put forth by the Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants AICPAAmerican Institute of Certified Public Accountants AICPA
Recommendations Researchers should ensure that CSPs have been independently audited against comprehensive and internationally recognized and respected information security standards, such as those promulgated by the International Organization for Standardization ISOO) and Statement on Standards for Attestation Engagements (SSAE).
Researchers should ensure that CSPs have been independently audited against comprehensive and internationally recognized and respected information security standards, such as those promulgated by the International Organization for Standardization ISOO) and Statement on Standards for Attestation Engagements (SSAE).
The 2007 Guidance has not been effective due to changing interpretations of PCAOB standards for attestations during the inspection process.
