Replies to post #61639 on Wave Systems Corp. (fka WAVXQ)

[Countryboy]

Army Acquisition Corps.

From the prior post:

“Much of the research is funded by the National Security Agency (NSA) under the direction of the NSA Visiting Professor, Dr. Aaron J. Ferguson, and the ITOC Director, MAJ Ronald Dodge.”

Lieutenant Colonel Ronald Dodge, JR., Ph.D., has served for over 17 years as an Aviation officerand is a member of the Army Acquisition Corps. His military assignments range from duties in an attack helicopter battalion during Operation Just Cause in the Republic of Panama to the United States Military Academy. Currently he is an Academy Professor and Director of the Information Technology and Operations Center (ITOC) at the US Military Academy. His current research focuses are information warfare, security protocols, internet technologies, and performance planning and capacity management. He is a frequent speaker at national and international IA conferences and he has published many papers and articles on IA topics. http://www.itoc.usma.edu/dodge/bio.htm

Army Acquisition Corps.

Mission

Support soldiers by continually improving our Army's combat capability and by developing the critical systems and services that enable our Army to meet its non-negotiable contract to fight and win our Nation's wars

Vision:
The premier developer of a strategically responsive force armed with the combat capabilities to dominate across the full spectrum of operations.

http://asc.army.mil/public/overview/mission/default.cfm

[summerblaze]

Country: SKDMARCS? sounds slightly scatological. But, hey, if it's Wave, it's great!

[go-kitesurf]

[edited] Countryboy,

It is interesting that the word trustlet is used in your link:

SKDMARCS is a Constructive Key Management-based technology used in conjunction with PKI that will facilitate development of a smart card-enabled content dissemination system. This system that will allow members in allied-coalition enterprise environments to access information based on role and "cneed-to-know". Cadets will write smart card reader "trustlets" (written in C) that will allow smart card readers to authenticate multiple smartcards/tokens into the enterprise.

This implies a programmable reader that can swap and execute multiple trustlets that will be authenticated to the network. Here is an excerpt from a Wave PDF:

EMBASSY Secure Smart Card TerminalsThe EMBASSY secure smart card terminal is a key component of the EMBASSY Trust System (ETS) for solving complex security problems precipitated by the information age. Comprehensive security functions must be integrated into every end user device creating a network of trusted clients, and establishing multi-party trust between devices, application service providers, and end users. The EMBASSY secure smart card terminal is the device that is trusted to uphold the security of applications by executing EMBASSY trustlets. EMBASSY trustlets are extensions of an application’s secure functions that are executed within the terminal and never exposed to the PC or to the Internet.

Furthermore, doing a Google on "trustlet" returns only references to Wave's Embassy System or this DePaul seminar.

Even further, the smartcard reader does not authenticate anything. The reader is a hardware device that loads and executes services, that's it:

The EMBASSY secure smart card terminal is the first generation of EMBASSY Trusted Client devices and is one of the three fundamental elements of the ETS. It is complemented by the EMBASSY Executive firmware and a backend infrastructure called the Trust Assurance Network (TAN).

The reader needs the firmware and the TAN to authenticate. Reading further:

Trust Assurance Network (TAN) server authentication, establishing a protected execution environment and authenticated delivery of trustlets.

Read this last blurb *very* carefully. The work *establishing* is the key word, imo. It is the TAN that delivers the ability to have a secure execution environment. There is no trust without the server. The chip in the reader is merely a box with a door, but the TAN is what holds the keys to open that door securely. [edited] What good is a safe that can be opened by anyone at any time? The method of authentication with a server is key.

Again, just like Wave's CSP, which is the last link in communicating to the TSS and TPM from the end user, the TAN is the last link in communicating to the other party in a trust environment. Once the key to open that door is issued, everyone else can get involved.

Once authentication is involved, it involves Wave, imo.

This is why Larry Dudash and GregS just don't get it. They think trusted computing is just about chips. They are *wrong*!!!