Direct Anonymous Attestation is a cryptographic primitive which enables remote authentication of a trusted computer whilst preserving privacy of the platform's user. The protocol has been adopted by the Trusted Computing Group in the latest version of its Trusted Platform Module specification to address privacy concerns. ISO/IEC 20008 specifies DAA, as well, and Intel's Enhanced Privacy ID 2.0 implementation for microprocessors is available for licensing RAND-Z along with an open source SDK.
Historical perspective
In principle the privacy issue could be resolved using any standard signature scheme and a single key pair. Manufacturers would embed the private key into every TPM produced and the public key would be published as a certificate. Signatures produced by the TPM must have originated from the private key, by the nature of the technology, and since all TPMs use the same private key they are indistinguishable ensuring the user's privacy. This rather naive solution relies upon the assumption that there exists a global secret. One only needs to look at the precedent of Content Scramble System, an encryption system for DVDs, to see that this assumption is fundamentally flawed. Furthermore, this approach fails to realize a secondary goal: the ability to detect rogue TPMs. A rogue TPM is a TPM that has been compromised and had its secrets extracted. The solution first adopted by the TCG required a trusted third-party, namely a privacy certificate authority. Each TPM has an embedded RSA key pair called an Endorsement Key which the privacy CA is assumed to know. In order to attest the TPM generates a second RSA key pair called an Attestation Identity Key. It sends the public AIK, signed by EK, to the privacy CA who checks its validity and issues a certificate for the AIK. the TPM's manufacturer must have provided an endorsement certificate.) The host/TPM is now able to authenticate itself with respect to the certificate. This approach permits two possibilities to detecting rogue TPMs: firstly the privacy CA should maintain a list of TPMs identified by their EK known to be rogue and reject requests from them, secondly if a privacy CA receives too many requests from a particular TPM it may reject them and blocklist the TPMs EK. The number of permitted requests should be subject to a risk management exercise. This solution is problematic since the privacy CA must take part in every transaction and thus must provide high availability whilst remaining secure. Furthermore, privacy requirements may be violated if the privacy CA and verifier collude. Although the latter issue can probably be resolved using blind signatures, the first remains. The EPID 2.0 solution embeds the private key in the microprocessor when it is manufactured, inherently distributes the key with the physical device shipment, and has the key provision and ready for use with 1st power-on.
Overview
The DAA protocol is based on three entities and two different steps. The entities are the DAA Member, the DAA Issuer and the DAA Verifier. The issuer is charged to verify the TPM platform during the Join step and to issue DAA credential to the platform. The platform uses the DAA credential with the Verifier during the Sign step. Through a zero-knowledge proof the Verifier can verify the credential without attempting to violate the platform's privacy. The protocol also supports a blocklisting capability so that Verifiers can identify attestations from TPMs that have been compromised.
Privacy properties
The protocol allows differing degrees of privacy. Interactions are always anonymous, but the Member/Verifier may negotiate as to whether the Verifier is able to link transactions. This would allow user profiling and/or the rejection of requests originating from a host which has made too many requests. The Member and Verifier can also elect to reveal additional information to accomplish non-anonymous interactions. Thus, known identity can be built on top of an anonymous start.
Implementations and attacks
The first Direct Anonymous Attestation scheme is due to Brickell, Camenisch, and Chen; that scheme is insecure and requires a fix. Brickell, Chen, and Li improve efficiency of that first scheme using symmetric pairings, rather than RSA. And Chen, Morrissey, and Smart attempt to further improve efficiency by switching from a symmetric to an asymmetric setting; unfortunately, the asymmetric scheme is insecure. Chen, Page, and Smart proposed a new elliptic curve cryptography scheme using Barreto-Naehrig curves. This scheme is implemented by both EPID 2.0 and the TPM 2.0 standard, and the TPM 2.0 standard recommends that this scheme is implemented by TPMs in general and is required for TPMs that conform to the PC client profile. In addition, the Intel EPID 2.0 implementation of ISO/IEC 20008 DAA and the available open source SDK can be used for members and verifiers to do attestation. Since one of the DAA attestation methods in TPM 2.0 is identical to EPID 2.0, work is underway to make ISO/IEC 20008 DAA and TPM 2.0 DAA attestation read consistently with each other at the spec level.
