"wd...as we've discussed, VSC would be an ideal method to secure PIV derived credentials on TPM-equipped gov't/military smartphones"
Agreed, and the TPM is one method of storing the Derived credential on the phone. NIST allows many ways to store the credential on the phone at different Trust Levels of assurance.
As we previously discussed they also allow the phone if it has a secure NFC channel and NFC capability on the phone to use a sleeve on the back of the phone to hold the CAC or PIV card and have the phone be used as a reader of the PKI user credential right off the card. No storage of the derived credential on the phone is required and no card reading sled is necessary, the phone is the reader.
The DOD is driving the NFC method.
Even if the NFC method is used the phone still requires a TPM on the device to be used for attestation services as per the NSA Mobile device requirements.
We all know by now that the TPM on the device can be a fTPM held in a secure element or TEE or a Secure Hypervisor Container and it can also be a discrete TPM chip 5mmx5mm as Infineon is producing and is awaiting Fips 140 certification.
"Guidelines on Hardware- Rooted Security in Mobile Devices (Draft)
While it is preferable to store cryptographic keys in protected hardware, or encrypt them with keys that are stored in protected hardware, mobile devices may, in some cases, use user-entered passwords to protect cryptographic keys stored on the device. Because such passwords typically have low entropy and weak randomness properties, these passwords shall not be used directly as cryptographic keys. NIST SP 800-132, Recommendation for Password-Based Key Derivation, provides guidelines on the use of a family of password-based key derivation functions that may be used to derive cryptographic keys from passwords for the protection of data encryption keys or key encryption keys [SP800-132].
4.3.3.2 Key Protection
Key protection shall be provided by the mobile device as a service, starting with one or more device keys that are contained in the RTS. In general, we consider two classes of keys : data encryption keys (DEKs), which are are keys that encrypt data, and key encryption keys (KEKs), which are keys that wrap other keys. Some KEKs are RTS-protected keys that in return protect DEKs and other KEKs. DEKs may be used for per-context encryption (e.g., separate keys for each Information Owner’s data), per-application encryption, data or file encryption, or any other encryption operation where an application-unique key is desired. The key protection service provides confidentiality and integrity through functions for wrapping, unwrapping, and loading cryptographic keys for use. The service could be implemented as a purely software-based service or with support from hardware such as the Trusted Platform Module described in the multipart ISO/IEC 11889 standard [ISO11889].
An Overview of Draft SP 800-157 Derived PIV Credentials and Draft NISTIR 7981 Mobile, PIV, and Authentication
Hildegard Ferraiolo PIV Project Lead NIST ITL Computer Security Division Hildegard.ferraiolo@nist.gov IAB Meeting March 26, 2014
slide 12
Draft NIST IR 7981 Mobile, PIV, and Authentication
A Companion Document to Draft SP 800-157
- Analyzes different approaches to PIV-enable mobile devices - Includes the use of PIV Cards with mobile devices in addition to Derived PIV Credentials - Points out benefits and considerations (pros/cons) for each approach
- Example: UICC approach requires cooperation with MNO - Approximates when these approach might become available - Categorized approaches in ‘current’ and ‘near term’ solutions - Includes Recommendations - Hardware rooted solutions provide better security - Software solution are available now – NIST IR 7981 recommends complementing these by hardware-backed mechanism to protect the private key of the Derived PIV Credential when not in use (the hybrid solution)
– In the longer-term, NIST IR recommends adoption of hardware-supported security mechanisms in mobile devices, such as the Roots of Trust (SP 800-164) to support stronger assurance of identity
News 
Market Data 
Discover 
