Register for free to join our community of investors and share your ideas. You will also get access to streaming quotes, interactive charts, trades, portfolio, live options flow and more tools.
Register for free to join our community of investors and share your ideas. You will also get access to streaming quotes, interactive charts, trades, portfolio, live options flow and more tools.
Doma, I can't explain how Verisign's attestation servers enable the processes of Verisign's PTA, if in fact they have anything to do with it, it's just that the PTA is the only Verisign solution listed in the TCG solution catalog and since it is listed in the Indentity Protection section which discusses attestation and since Wave's ACM is the only other solution in this section, and since both Wave and Verisign are mentioned for having attestation servers...
https://www.trustedcomputinggroup.org/downloads/TCG_Solutions_Catalog.pdf
Identity Protection
Digital certificates are commonly used as proof of identity for access to data and
services. The asymmetric keys tied to certificates are also the basis for digital
signatures. Theft of a digital certificate allows substantial opportunity to commit
crimes of fraud and unauthorized access. Fraud or forgery using a stolen digital
signature is not easy to prove. Further, since a digital certificate could be stolen
by making a copy of it, it could take the owner some time to realize a theft had
occurred. Therefore, it is extremely important to provide the best possible
security around the storage and use of digital certificates. Hardware-protected
digital certificates provide a safeguard against theft.
Customers interested in deploying digital certificates as identity credentials or
signing tools often touch on the following requirements:
• The certificate must be secured, preferably through a dedicated piece of
security hardware, and unavailable when not in use.
• Access to the certificate must be controlled by the use of strong and
flexible authentication.
• It must be possible to customize authentication policy for different users
and groups of users.
• It must be possible to back up and migrate the certificate (and it’s keys),
but it must also be possible to restrict who can do this and under what
circumstances.
Additionally, the TCG specifications for providing attestation capabilities to
trusted platforms, includes a requirement for credential management. These
products may reside within the enterprise’s global network or in an outsourced
model to issue secure TPM Identity and Certified Credentials to platforms for use
by various applications and service providers. These products attest to a trusted
platform’s Endorsement, Platform, and Conformance credentials and issues TPM
Identity Credentials that are vouched for by this trusted third party architecture.
Verisign* http://www.verisign.com
Verisign delivers critical infrastructure services that make the Internet and
telecommunications networks more intelligent, reliable, and secure. Every day
VeriSign helps thousands of businesses and millions of consumers connect,
communicate, and transact with confidence.
Verisign’s client software, Personal Trust Agent* (PTA) uses the TPM to protect
Verisign digital certificates stored on a PC.
Wave Systems Attestation Credential Manager*
http://www.wave.com
Wave Attestation Credential Manager allows the use of certified credentials for
3rd party attested authentication. This product is capable of integration with
authentication, digital certificates and platform credential systems. The ACM
architecture offers an exclusive set of complementary services for the PC
security industry. The implementation is highly configurable, and supports add-in
modules, allowing the users to deploy only the services that are necessary to
satisfy the business requirements. For example, it can issue specific-purpose
Certified Credentials that have undergone extra validation for the business.
When advanced credentials are required, ACM may contain a Registration
Authority (RA) to verify information provided by the trusted platform. These
advanced credentials can authorize some platforms to have higher levels of
authority than others. In addition to advanced credentials, Wave’s ACM
architecture supports the following services: Credential revocation, Online
credential status reporting, Online credential verification, Attestation of TPM
security, Attestation of platform security configuration.
Doma, thanks for another great TCG find!
https://www.trustedcomputinggroup.org/downloads/TCG_Solutions_Catalog.pdf
I think this is ironic when considering the NEC/Wave Secure PC:
"Only IBM offers the most secure industry-standard PC to provide more secure
local file and folder encryption, wired and wireless communications, and user
authentication to control system and network access. In fact, you cannot get a
higher level of security as a standard feature on a PC from any other manufacturer."
doma/awk/rachelelise, speaking of Verisign, here is the only Verisign solution listed in the catalog:
"Verisign delivers critical infrastructure services that make the Internet and
telecommunications networks more intelligent, reliable, and secure. Every day
VeriSign helps thousands of businesses and millions of consumers connect,
communicate, and transact with confidence.
Verisign’s client software, Personal Trust Agent* (PTA) uses the TPM to protect
Verisign digital certificates stored on a PC."
So does the above function utilize the Verisign attestation server?
barge/awk, great stuff tonight. Thanks. e/
yayapapadoc
Bad things about continued sell-off:
1. Lousy price for next equity offering (if necessary), leading to more dilution. This is the big issue.
2. Poor opportunity for Wave staffers to exercise options.
3. Greater opportunity for unfriendly hands to accumulate...I don't think this is really an issue.
4. Lousy peace of mind for Wavoids and other investors.
Good things about continued sell-off:
1. Cheaper shares for Wavoids/Wave staffers to accumulate for long-term core holdings.
2. Cheaper shares for Wavoids/other traders to open position for shorter-term gains. Example: Wavoid lacks the cash to invest for additional long-term core holding, so opens shorter term position and then sells for gain and uses the profits to add to core holding. At today's prices modest cash still buys a lot of shares.
I think if the company is planning on raising another offering, share price is critical and I am sure news will be timed for that purpose.
go-kitesurf
Awesome DD in contacting the TCG and getting referred to Wave! I like your hunch about Wave and the TSS...very plausible!
Thanks, R2
Doma re: NSM SafeKeeper TPM
Consider the Endorsement Key loading issue; I wonder if this capability was incorporated into the original NSM TPM? Perhaps not...could further explain the delay and redesign.
We can be certain that the SafeKeeper is now EK loaded? Seems like a reasonable assumption.
Wonder how Atmel and Infineon are coming with the EK issue.
Doma, great find on the TCG site! This highlights the importance of checking back for updates!
I can't explain the specifics but I think Verisign's attestation servers are specific to what Verisgn does with digital certificates, and Wave's attestation servers are specific to Wave's credentials etc. management roles.
cpa re: POs
IMO POs are not impossible...so as far as I'm concerned cmf has indeed identified a possible means for the company to forecast revenue. NSM/Intel licensing is not the ONLY potential source of near-term revenue. There is also possible Cubic business, just to name one possibility.
cmf re: POs...agreed. e/
cpa
Well I would guess that Wave will "book" revenues ASAP in order to keep the market interested in the stock.
Really, assuming the company succeeds, the share price between now and that success, matters the most if another equity offering is necessary, otherwise it's just a matter of keeping shareholders and traders happy with the price and action of the stock.
cpa re: forward looking
So in your estimation "positive forward looking" PRs, if you will, or statements at conference calls, relating to revenues are not possible or likely?
Let's say Wave begins to see licensing revenue Q4, even if it is not booked and then reported until Q1 2004, this would be meaningful to the future of the company. No way for management to effectively PR?
And of course Q4 revs are not necessarily limited to NSM/Intel licensing. There is Premium Services to IBM, possible WXP, Cubic and others.
Why should management hands be tied to actual revenue reporting several months down the road if the cash begins to come in now?
Guidance?
awk, I hope your assumption that NSM chips have been shipping for a while is correct...it's possible...perhaps the response I got from NSM was geared towards the consumer and not the enterprise buyer. Anyways, if the SafeKeeper has indeed been shipping it could get a mention in the upcoming CC.
2004riptide re: guidance
I admit I don't know if "guidance" is a viable strategy for management if they see a couple million or a bit more flowing in at the time of the Q3 call. I should probably research "guidance"...who knows, I might find it really is limited to earnings, and just does not apply to revenues.
If you were Wave and reported negligible revenues for the third Q, but finally had some pretty decent cash rolling in halfway through Q4, and really wanted to keep your share price north of say $2, what would you do? I mean, you might come up with something to say or do.
oknpv re: NEC/Wave secure computers
I think the issue is that the NEC/Wave Secure PC is a possible competitor to the TCG platform, but I believe the Samsung/Wave keyboard can be integrated into TCG. I think also that NEC is probably going to be going the TPM route which muddies the NEC/Wave Secure PC waters somewhat. Overall Wave wants to be careful not to compete in any way against the TCG iniative.
One thing I wonder about is the subscription by Secure PC users to Wave's TAN...seems like @ 8-10K units deployed, that could have brought in a modest six $ figures in service subcriptions.
2004riptide re: the price of WAVX forward through Q4
One obvious option that management has for supporting the share price is to issue guidance during the upcoming Q3 call which should be held mid-Nov. I don't know why such a choice would not be feasible if indeed we see a signifigant ramping up of National Semiconductor TPMs and Intel/Wave motherboards beginning this quarter, not to mention HP/IBM possibilities including subscription of Premium Services by the existing IBM deployment.
awk, we don't know yet how the NSM Safekeeper will be implemented...DB or MB. Once it's released on the website (they told me Oct. 6), I plan on e-mailing them on the particulars.
Attn: doma/awk/rachel/others
I believe I am correct that Atmel and Infineon TPMs, as deployed by IBM and HP, have been daughterboard implementions, whereas the upcoming Wave-enabled Intel motherboards will actually have the TPM (an Infineon) soldered onto the motherboard. Interesting that it will be soldered and not slotted in...good because it can't be removed? Slotted does mean plugged in?
Also, we will likely continue to see daughterboard TPMs per IBM and HP machines or perhaps slotted on the MB?
Of course the best situation will be to see TPMs standard on all MBs.
rachel
It sounds like retrofitting existing machines with a TPM by replacing the MB (I have twice replaced the MB on my machine) will be a game for certain consumer users or possibly small enterprises.
rachel re: replacing machines
After all, the PC industry is geared towards replacement of the entire machine since this is more profitable for PC makers...understandable.
Thanks for your response.
go-kitesurf re: programmability
You write:
"The quotes relating to their chip are of particular interest since Wave will most likely not see wide-adoption of the Embassy chip in favor of TPMs."
By offering a datasheet on the Wave website entitled Embassy TPM, SKS has apparently left open the possibility that the Embassy 2100 chip can be considered a TPM. At least that is how I interpret it. Personally I fail to see how trusted web services can be effected without a programmable security crytographic processor.
You will note that the datasheet does not spec the Embassy 2100 chip, but the fact remains that the concept presented is that of an Embassy TPM.
http://www.wave.com/about/datasheets/03-000138_TPM.pdf
rachelelise
I own a custom built machine that I got through a personal reference to a Los Angeles store...Chinese folks actually. It was not expensive...I requested extras including a high speed hard drive and a dual monitor graphics card. The original MB was probably as cheap as they get and failed within a year (may have been spikes as I had no surge protection). When replacing the MB I upgraded to a faster Athlon. Then about 14 months later the new MB failed again (I had surge protection)and this time I upgraded the processor to an even faster Intel Celeron.
My question is: do enterprise customers sometimes upgrade MBs and CPUs (or other features) on their machines without changing the chassis, or do they normally just replace the whole machine? I have been told that box products like HP are not easily upgradeable.
Doma, nice DD on MBs. regards, R2 e/
dhamster, always a pleasure! e/
P.S. re: PC21100 SafeKeeper
I have countered with request to NSM for info on timeline for volume production of the product.
Just got this e-mail from National Semiconductor:
"In response to your request:
The PC21100 is scheduled to be released for sale on
October 6, 2003. The datasheet and samples will be
available at that time."
http://www.national.com/pf/PC/PC21100.html
HhH re: 1M units/month
If there was no such thing as a TPM, enterprise would not upgrade their equipment to whatever else was available? You appear to presume that 1M units/month of enterprise computer upgrades is unusual.
doma, you have mail. e/
See last post edited. Great feature! e/
Doma
Looks like TPMs are here to stay. They are/will continue to be the fundamental piece of hardware in Trusted Computing.
Current TPM is a crytographic processor. It's plausible that it will evolve into a programmable crytographic processor. Perhaps when it becomes programmable it would more appropriately be termed a "co-processor", as indeed the host platform's processor, also programmable, will remain the "main processor".
In addition to the TPM however, there will be additional hardware-enabled security aboard the host's processor (the main processor) to facilitate certain secure/trusted functions within the host's operating system, eg. Windows/Linux. These functions, enabled by updated Intel/AMD processors (eg. Longhorn/SEM) will be executed in the "secure" OS (eg. Windows NGSCB).
We can assume the TPM will remain a vital, mandatory component in the TCG platform, no matter what additional hardware-enabled security functions are incorporated into the host's processor?
P.S.
Sorry for the contradiction:
I open by stating that TPMs are here to stay and finish with a question; will added security in main processors eventually eclipse the need for a TPM?
Doma
As you say, it seems Wave's (first two) Premium Services (Attestation Credential Manager and Key Transfer Manager) are part of the TCG spec and essential.
TCG Software Stack (TSS) Specification
Version 1.1
August 20, 2003
Key and Credential Manager are found here in the TCG Core Services:
1.7.2 TCG Core Services (TCS)
Start of informative comment:
A service provider is any component used by the application that allows that application access to the
TCS (and thus the TPM) from within the application’s process. Service providers, of which the TSP is
but one possible instantiation, cannot communicate directly with the TPM. Additionally, there are
multiple common services that either must or should be shared among the set of the platform’s
service providers.
The TCG Core Services (TCS) provides a common set of services per platform for all service
providers. Since the TPM is not required to be multithreaded, it provides threaded access to the TPM.
End of informative comment.
Any service provider MUST be allowed to connect to and obtain services from the TCS. The TCS
MUST not restrict access to only a TSP.
The TCS MUST provide single threaded access to the TPM.
1.7.2.3 TCS Key & Credential Manager (TCSKCM)
Start of informative comment:
Key and credential may be associated with the platform, the user, or the individual applications. In all
cases it may be more convenient for an application to use a common resource to store and manage
the keys and credentials. Key and credentials associated with the platform (e.g., The Endorsement,
Platform, and Conformance Credentials) should be stored and managed by the Key and Credential
Manager to allow multiple application access to them.
The Endorsement and Platform credentials contain information that identifies the specific platform
thus these are considered privacy sensitive. Other credentials and keys my also contain privacy
sensitive information. The TCSKM must, therefore, provide a mechanism to protect this information
from unauthorized access.
End of informative comment.
The TCS MUST provide the functions required to perform Key and Credential Management as
described in this document.
The TCSKM MUST provide a mechanism to protect privacy sensitive keys and credentials from
unauthorized access.
Nope. Right URL...not clickable. e/
Doma
Maybe this URL works:
https://www.trustedcomputinggroup.org/downloads/TSS_Version__1.1.pdf
VH2/JKIRK57
I especially like this part from Berlind's article...this sounds a lot like Wave's Key Transfer Manager (and Attestation Credential manager)!
"For example," says Austin, "not only can it help to manage a situation where I move from machine to machine (or device to device) and it knows that I'm Jeff Austin, but it helps the IT department manage whether a particular system or device is allowed to access the network. When you combine those two things, an IT department can set rules for what systems or devices Jeff Austin is permitted to access the network from."
The above is a good illustration of how useful these early TPMs will be to enterprise networks. This is early TC, to be followed by secure application communications, which users will demand.
And Berlind has got the following right...TPMs are, in their present capacity, a keys management technology:
"The TPM is a motherboard-based authentication system that can add a cryptographically unique identifier to every system. To the end user, TPM will serve as a hardware-based storage mechanism for holding any keys that might be needed to manage encrypted activities."
The $64K question:
Precisely how will the TPM platform evolve from a keys management technology to a secure application technology? Is it possible to accomplish this without embedding a security co-processor in the TPM?
Sorry VH2. Your diligence is always appreciated. Thanks. R2
JKIRK57
Great find...the David Berlind article.
I had some dealings with him a couple of years ago, in providing him with some info on Wave prior to Comdex 2001, including an Embassy whitepaper. This was the Comdex where Dick Brown of EDS delivered a keynote. Berlind was responsive to my inquiries about his potential interest in Embassy at the time. I wonder if he is aware of Wave's current role as network enabler in Trusted Computing, or if he even knows about the Wave/Intel motherboard.
Thanks and regards,
Ramsey2
nice find awk...sure looks like that's Wave.
Doma P.S.
BTW, your depiction of TPMs as a key management technology vs. a secure application technology is compelling. Your inference that Java wants to store keys on TPMs sounds right on. A lot can happen between now and NGSCB/Lagrande!
Doma
The TCG Software Stack is no substitute for a security co-processor?
A 64K question:
Is Intel moving in the direction of embedding a co-processor into the main processor?
Doma
Agreed. We sometimes (oftentimes) get too far ahead of ourselves!
awk, great points...100% agreed...except you write:
"2. NGSCB/LaGrande security infrastructure will be compatible with the above and vice versa. Whether the OS is gonna be called the "EMBASSY OS" or something else is materially of no importance."
I see what you are saying about the NGSCB/LaGrande security infrastructure being compatible with Embassy silicon (in an SCR or keyboard) and as a matter of principle that the name of the OS is not materially important to the operation of the platform, but I would like to add that it would be very nice if the the Embassy name finds it's way onto the TPM platform, as a hardware enabler. That couldn't hurt!