Continuing dismissing the SE API

There are already hundreds of millions users of mobile devices featuring embedded SEs.
There are also numerous mobile bank apps in active use.

However, there's no practical way using the embedded SEs of the aforementioned devices for storing keys for the mobile bank apps.
This is not due to a lack of an SE API, it is rather rooted in the SE concept itself.

Some people claim that this is the "intended business model" for SEs, while another camp (including myself) point out inferior SE technology as the culprit.
Creating a useful SE API under these circumstances is probably no easier than resolving the middle-east conflict.

If "losing face" is the primary consideration for keeping the SE API in the charter, the only realistic option is "rubber-stamping" Gemalto's proposal.
I don't have a problem with that but it doesn't have much to do with what you generally mean when you refer to something as a "standard".

thanx,
Anders Rundgren
Invited expert, Trusted Computing Group

Received on Thursday, 25 July 2013 06:12:50 UTC