Abstract :
Trusted computing base (TCB) subsetting consists of subdividing a large TCB into smaller separate TCBs, each of which can be separately designed, implemented, and analyzed. The idea of TCB subsetting is attractive because it can simplify the difficult task of constructing TCBs. However, there are many unanswered questions, connected in particular with determinating the useful and meaningful ways of subsetting a trusted system. It is concluded that the notion of TCB subsetting is appealing, but there are many pitfalls and unanswered questions, making it necessary to ensure that the cost is commensurate with the benefits
