Replies to post #239397 on Wave Systems Corp. (fka WAVXQ)

[wavedreamer]

ROT,

"Btw, I find merit in your NIAP Protection Profiles approval process involving the 26 nations (thanks for your DD). Whereas any gov't can move forward with TPM deployment (e.g. Wave's U.S. gov't VSC customer), you're correct that the NIAP approval will make it easier for TPM-management vendors (e.g. Wave) to sell into the 26 nations. Wave has gov't sales initiatives today (in the U.S. and the U.K. for sure and possibly others) but for Wave to show customers the NIAP Protection Profiles process is a bullet point. Even ahead of the approval."

Thanks for the complement.

When you see 26 Nations involved in developing those Technical Protection Profiles and then getting accredited Labs up to speed to certify products you can see why the NSA/NIST and the CESG's of the Nations are involved. Many Gov'ts want their say in the securing of the Internet Of Things.

It's beyond complex but it's necessary. Once more TPM 2.0's get into the wild it will enable any country to chose from a menu of encryption algorithms they want to use. But this will not stop the use of the TPM 1.2 for certain applications. JMO

[RootOfTrust]

As I stated before the CAC card will be used as the primary Token for User ID in the DOD and the VSC can be a backup to it as well be used in the Federal space for machine ID and 2 factor authentication and lead to Attestation services like WEM provides.


wd...as we've discussed, VSC would be an ideal method to secure PIV derived credentials on TPM-equipped gov't/military smartphones, in fact I'd be surprised if the the gov't VSC customer went forward with their deployment not considering the possibility of that scenario. If I'm correct and the customer eventually deploys Wave VSC on smartphones then it's an easy step to use derived credentials on notebook TPMs and bypass the need for both a card reader and a card. That way the soldier in the field isn't screwed if he/she loses their card, just use the PIN to gain access to the notebook and he/she is on the network.

I realize the NIST Derived Credentials draft applies to using PIV derived credentials for mobile devices only, but who knows if they become widely deployed on smartphones perhaps the IT guys will get creative and use them on PCs (especially notebooks) as well.