And the attacker doesn't care if the key gets revoked after they've stolen your money.
it will also create a market for people selling and buying keys
it'll be like buying a grey market software key, you hop onto aliexpress, pay $5 and you'll have an iphone 11 attestation key
remote attestation as a process sows the seeds of its own destruction
Even if it's possible, that too will be a cat and mouse game which won't work for long. Hardware DRM has been an evolving industry, and now with the commonality of TPMs and HSMs it's here to stay.
HSMs often misbehave or leak data when operated out of spec, as when the OEM's cheap logic board has voltage drop. Moreover, using the same piece of hardware across a hundred million devices is its own vulnerability, because then that's the one everyone is focused on breaking, and when anyone succeeds now they can extract the keys from a hundred million devices.
> Even if it's possible, that too will be a cat and mouse game which won't work for long.
The nature of it is to be physical hardware, so vulnerabilities commonly require the hardware to be replaced. Now you've got an active vulnerability for the lifetime of that hardware, which is typically at least 3 years. Meanwhile they find new ones every year.
Preventing this may not even be physically possible. The key has to be inside the device and the attacker has physical control over the device. Even if the equipment needed to extract it is expensive, the device itself can't be if you expect everyone to have one, so someone with that equipment makes a business out of extracting keys and selling them over the internet.
> now with the commonality of TPMs and HSMs it's here to stay.
Nothing lasts forever. Especially if you make a good show of burning it to the ground.
So this is going to be the interesting question, because obviously they can, they just have to extract the keys from something first. Devices are made by all kinds of vendors and it only takes one vulnerability before you have a market for keys. There are <$200 phones, those cheap phones are more likely to have a vulnerability, and when one of them gets a cracked screen the market value drops to near-zero which makes it cheap to buy one to extract the key.
Which is also why remote attestation is totally worthless. An attacker can do the same thing, so relying on the attestation is completely insecure because in practice anyone with a couple bucks will be able to spoof it.
But if extracting a key is mildly inconvenient or legally questionable, it will be enough to deter honest casual users but not profit-motivated attackers, and you get the worst of both worlds.
So we need to do everything to make sure that doesn't happen. One way is to make extracting keys as easy as possible, of course.
Another is to make sure that everybody understands the perversity of this nonsense. It's snake oil the likes of export-grade encryption or EV certificates. Anyone caught using it should be mocked mercilessly and added to a list of disfavored vendors with uninformed security staff. Anything in a position to do so should warn if anything attempts to use it, or disable it to make it more difficult for anything else to rely on its availability. Warnings should emphasize that using it is a security risk that can enable hard to detect malware and is an indication of malice or incompetence.
It needs to go away.