3 ms·
I don't understand the usecase. If the application is loaded from the host, why is this better than the host running the application directly?
by mongol 3y ago
I don't understand the usecase. If the application is loaded from the host, why is this better than the host running the application directly?
- AgentME 3y agoThe program running on the device is able to access a special Compound Device Identifier secret, which is only available by running that specific program on that specific device. Any different program you run on the device gets its own unique CDI secret, so it's not possible to load a secret-dumper program onto the device and grab the CDI available to a different program. You could use the device to implement a TPM/HSM with application-specific logic, even like a cryptocurrency wallet. A program on the device could be made to generate its own private keypair using the CDI, announce the public key to the connected device, and offer to sign messages using its keypair under some specific conditions enforced within the program.