After evaluating a number of CPoC and SPoC solutions, UL has observed a number of common issues. This talk discusses some of the more problematic SPoC/CPoC requirements and potential solutions.
- Application layer cryptography, not relying upon TLS
- Key provisioning using forward secrecy
- Key storage and processing
- Local vs. remote attestation
- Random number generation
- Detecting ADB and developer options