\chapter{State of Work and Outlook}
\label{cha:conclusion}

\section{Limitations}
\label{sec:limitations}
\begin{itemize}
  \item older TPM does not support ECDAA
  \item Documentation available for TPM APIs, but no changelog for \texttt{tpm2-tools}.
  \item Trusted boot and IMA can just handle static resources like files, kernel modules and firmware of hardware components.
  Code transmitted over network or otherwse dynamically generated can not be recognized.
  This is an open door for non-persistent attacks.
  \item Documentation on IMA is mostly outdated and so are some tools.
  Further customization of rules may be useful to reduce log size.
  However major Linux distributions support IMA by default on recent releases.
  \item Complexity of verifying system state is too high and is connected to system complexity.
  Reducing number of dependencies and relevant file count is key for this problem.
  \item Implemented DAA does not support a full dynamic group scheme.
  This might be useful in the future, maybe with a custom implementation of a recent DAA version.
\end{itemize}


\section{Future Work}
\begin{itemize}
  \item Remove building tools on target device - just deliver binaries
  \item Remove complex runtime environments like Java, Python, etc. to reduce bloating the integrity logs
  \item Set file system read only, just use e.g. a ramdisk for working files
  \item Integrate USB sensors into the trusted/integrity environment, including device firmware.
\end{itemize}
\subsection{Closing the chain of trust between TPM manufacturer and DAA issuer}
Activate a credential with to certify that the Membership key is in the Endorsement hierarchy, which can be verified with the TPM certificate.
\begin{itemize}
  \item Theoretical concept in the \emph{Practical Guide to TPM 2.0, pp 109 ff}
  \item Practical approach: with EK, AK and AIK to show validity of EK:\\ \url{https://ericchiang.github.io/post/tpm-keys/?utm_campaign=Go%20Full-Stack&utm_medium=email&utm_source=Revue%20newsletter#credential-activation}
  \end{itemize}

  Further integration in the Digidow environment if DAA is useful for that.

  \section{Conclusion}
  Hardening of the system beyond IMA useful.
  Minimization also useful, because the logging gets shorter.