This is a template for slides for TPAC 2024.

Author(s)
The user manual at the end has setup information and instructions.
To write slides, look at the slides in this template.

Reader(s)
To start the slide show, press ‘A’. Return to the index with ‘A’ or ‘Esc’. On a touch screen, use a 3-finger touch. Double click to open a specific slide. In slide mode, press ‘?’ (question mark) to get a list of available commands.

If it doesn't work: Slide mode requires a recent browser with JavaScript. If you are using the ‘NoScript’ add-on (Firefox or the Tor Browser), or changed the ‘site settings’ (Chrome, Vivaldi, Opera, Brave and some other browsers), or the ‘permissions for this site’ (Edge), you may have to explicitly allow JavaScript on these slides. Internet Explorer is not supported.

current timeusedremaining
Leaving slide mode.

DBSC(e)

Aleksandr Tokarev

TPAC 2024
Anaheim CA, USA
hybrid meeting
23–27 SEPTEMBER 2024

Authors & Contributors

  • Sameera Gajjarapu, Microsoft
  • Aleksandr Tokarev, Microsoft
  • Olga Dalton, Microsoft
  • Kristian Monsen, Google
  • Phil Leblanc, Google
  • Will Bartlett, Microsoft
  • Arnar Birgisson, Google
  • Sebastian Lalancette, Google
  • Kai Song, Microsoft
  • Amit Gusain, Microsoft
  • Paul Garner, Microsoft
  • Erik Anderson, Microsoft
  • Pamela Dingle, Microsoft

Why?

Threats in recent years

DBSC vs DBSC(e)

DBSC

  • Theft from a storage
  • Theft in-usage
  • Theft during sign-in by highly priviliged actor

DBSC(e)

  • Theft from a storage
  • Theft in-usage
  • Theft during sign-in by highly priviliged actor
  • Compromise of a device during initialization

DBSC vs DBSC(e) risks

[DBSC vs DBSC(e) comparsion]

DBSC(e)

Device registration

Attestation key

An attestation key is generated during the device registration process and has the following properties:

  1. Signing occurs only if the private key resides in the same secure enclave as the attestation key.
  2. It cannot sign any external payload, or if it does, it cannot generate an output that can be interpreted as an attestation statement.

Binding key validation

Additional to the binding key, DBSC(e) produces a binding statement, a statement that asserts the binding key was generated on the same device as the attestation key.

Privacy consideration

Q & A

https://aka.ms/dbsce