At a minimum, a trusted channel represents a way to ensure that data travels from one computing entity to another without any interference.
Most trusted channels also include the requirement of confidentiality, which means that not just any viewer of the channel can determine the contents of the channel. One mechanism that provides both properties is encrypting the data that is using the channel. Trusted channels come in two basic mechanisms: hardware or cryptography. Both have some ad-vantages and disadad-vantages.
Hardware Trusted Channels
A hardware trusted channel relies on the physical nature of the platform to provide protections. A typical hardware trusted channel involves such fun things as buried traces, no visible pins, and no exposed via’s. If you didn’t understand those terms you are not alone, these terms are the providence of the platform hardware engineers. The underlying idea of hardware trusted channels to is prevent an entity with physical access to the platform the ability to watch or disrupt the electrical signals traveling between devices.
Chapter 9: Protected Input and Output 147
Two major issues with hardware trusted channels are: first the chan-nel must be designed and built during platform manufacturing, and sec-ond, the channel is only possible with devices that are in physical contact.
The first issue of designing for the channel during platform manufac-turing is not serious, if the manufacturer wants to apply the time and ef-fort to the protections; the hardware trusted channel is possible3. Few commercial platforms take the time and go to the expense to create hardware trusted channels.
The second issue is much more serious. The hardware nature of the protections applies to all links in the chain between the two devices.
Some devices are very difficult to physically connect and even when physically connected the attempts to provide hardware protection is im-possible, or nearly so. What is necessary is some other mechanism to provide the trusted channel.
One interesting side feature of a hardware trusted channel is that the normal designs require no operational setup. With the physical nature of the channel, turning the platform on enables the protection.
Cryptographic Trusted Channels
The cryptographic trusted channel solves some of the hardware trusted channel issues while adding some new issues. The cryptographic channel solves the physical connection issue by encrypting all data traveling be-tween the two devices. No more worries about the physical nature of the connection, in fact the trusted channel can be huge distances as the SSL connection between a Web site and a Web browser shows.
The issue with cryptographic trusted channels is key exchange. To provide sufficient speed and bandwidth most, if not all, cryptographic channels use symmetric encryption. Symmetric encryption requires the same key at both sides of the channel. A truly ugly question now comes up, how to accomplish the key exchange.
Key exchange is not easy. The protocols are difficult, exacting, and sometimes use lots of bandwidth. To create a channel though, the prob-lem must have a solution. The steps to establish and use a trusted chan-nel look something like this:
1. Find both end-points. It does not matter how the end-points are found; one side can look for the other. The search can be across the Internet or through buses on a platform.
3 For many platforms built to military specifications, the hardware trusted channel is a requirement.
148 The Intel Safer Computing Initiative
2. Say hello. Essentially, one side sends a message that says,
“I would like to start a channel.”
3. Verify the end-points. One side verifies the identity and authori-zation of the other side, or both sides verify each other. The checking can be very simple or very complex. The checking can involve cryptography to validate and protect the answers.
4. Create a session key. The session key encrypts all data using the channel. The session key should be ephemeral, so that when the channel terminates, the session key is lost forever. Many proto-cols combine the end-point validation with session key creation.
5. Establish channel. With the session key at both end-points, all future traffic on the channel uses an encryption algorithm to en-crypt all traffic. The “distance” between the two end-points does not matter to the integrity or confidentiality of the channel. As long as both sides properly protect the session key, no interven-ing entity can read the data. The cryptographic strength of the al-gorithm and key can affect the strength property. If a reasonable algorithm, such as AES, and a decent key size, such as 128 bits, is in use, then intervening entities have a very low probability of success.
6. Terminate channel. Either side can terminate the channel, at any time. One efficient and effective way to terminate the channel is to destroy the session key.
Trusted Channel Device Focus
Devices that support the trusted channel may also support usages with-out the trusted channel. Some devices must make provisions for contin-ued use of the device when the focus changes from the trusted application to an untrusted application. One example of changing focus is the trusted channel to the keyboard, when the trusted keyboard driver has the focus, all of the keystrokes travel through the trusted keyboard driver. When an untrusted driver has the focus, the keystrokes may or may not travel through the trusted driver. Determining which entity has the focus is a critical ability of the trusted driver in order to properly handle the channel.
Chapter 9: Protected Input and Output 149