## 3 A Trust Anchor for a Home Network's CA
### Advanced Attacks on the TPM CA  
Although the TPM-protected HK of a Home CA cannot be stolen, different attacks are possible that can lead to identity theft. For example, an attacker who has introduced malware into the Home CA can eavesdrop on the PIN. The possession of the PIN enables the attacker to create a certificate. Alternatively, malware could trick the Home CA during the certification process to certify a public key that belongs to the attacker. Although this kind of attack is difficult to perform, it is still possible. Therefore we consider the trustworthiness of a Home CA's execution environment as crucial, at least during the certification process.  
Trusted Services within Home NetworksWe propose the following countermeasure: we run the TPM Home CA within a _trustworthy execution environment_. Trustworthy means that only well-known and verified software is installed within the execution environment.  
The TC technology provides a mechanism referred to as _Remote Attestation (RA)_ which is able to assess the status of an execution environment. For RA, integrity measurement values (SHA-1 fingerprints) are recorded by the TCG's _Trusted Boot_ process and IBM's _Integrity Measurement Architecture (IMA)_[16]. Both technologies make use of properties of the TPM that allow for the tamper-proof creation and reporting of measurement values. The fingerprints are sent to a verifying external entity for assessment. This verifying entity needs to be equipped with reference fingerprints of trustworthy software and can compare the fingerprints. When all reported fingerprints match the reference fingerprints, the verifying entity can be confident about the trustworthiness of the remote system, _i.e._, about the absence of malware. The result of this verification can be sent to the owner of the home network via a secure channel before the certification process starts, _i.e._, before the owner enters his PIN for unlocking the Home Key (see Figure 6).  
From practice, we know that the crux here is complexity: the trusted execution environment must be small and well defined in order for RA to be feasible. The extreme diversity of operating systems and software components is a major obstacle for RA services as no verifier would be able to know fingerprints of all software used.  
(Virtualized) Trusted Execution EnvironmentsOur proposal is to use small and strictly predefined operating system images that only run the TPM CA. For instance, such operating systems could run on dedicated low-cost devices or within virtual machines on XEN-like architectures. For XEN VMs, early implementations exist that provide access to a virtualized TPM. Virtualized TPMs make use of the hardware TPM of the machine and basically can be used within a virtual machine just like a hardware TPM [17].  
The needed operating system images, either for a dedicated device or the virtual machine, can be distributed by trusted entities on the Internet. This distribution process could be realized like the distribution of signed software packages of today's Linux operating system packet managers. If Home Certificates issued by the CA of an ISP are used, the ISP could also distribute the operating system image.  
For both options, dedicated device or VM, the small scale and predefined operating system image allows to establish the trustworthiness of the TPM CA during the certification process of an entity. Note that this works with either of the two methods we have described in Section 2.