Subject: [Suit] intentional rollback of firmware

From: Michael Richardson <[email-masked]>
Date: Wed, 11 Dec 2019 13:37:14 -0500

The SUIT Architecture is clear that we need to prevent rollback attacks.
    https://tools.ietf.org/html/draft-ietf-suit-architecture-08#section-3.4

and this is also mentioned in SUIT-manifest 5.1.  But I can't find any
"hit-them-over-the-head" text in either Security Considerations explaining
how a customer should do a planned back out of a upgrade.
(Specifically: a higher manifest sequence number pointing at an older
firmware binary)

This implies that the customer/operator is able to produce signed manifests
that the device is willing to trust.

This has come up in the context of firmware updates for OpenBMC.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Dave Thaler <[email-masked]>
Date: Wed, 11 Dec 2019 18:46:27 +0000

https://tools.ietf.org/html/draft-ietf-suit-information-model-04#section-4.3.1 says:
>   Note: This is not a firmware version.  It is a manifest sequence
>   number.  A firmware version may be rolled back by creating a new
>   manifest for the old firmware version with a later sequence number.

The information model doc is referenced in several places in the architecture, but maybe it should be explicit about the threat model is covered in detail in the information model document.

Dave

-----Original Message-----
From: Suit <[email-masked]> On Behalf Of Michael Richardson
Sent: Wednesday, December 11, 2019 10:37 AM
To: [email-masked]
Subject: [Suit] intentional rollback of firmware

The SUIT Architecture is clear that we need to prevent rollback attacks.
    https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-ietf-suit-architecture-08%23section-3.4&amp;data=02%7C01%7Cdthaler%40microsoft.com%7Cf061bcb0dab747e06b2e08d77e692a28%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637116862460595657&amp;sdata=kp2u1h2skhvm1cn%2BhYRg0i5m7qe%2BAuvNzxLe464M1lw%3D&amp;reserved=0

and this is also mentioned in SUIT-manifest 5.1.  But I can't find any "hit-them-over-the-head" text in either Security Considerations explaining how a customer should do a planned back out of a upgrade.
(Specifically: a higher manifest sequence number pointing at an older firmware binary)

This implies that the customer/operator is able to produce signed manifests that the device is willing to trust.

--
Michael Richardson <[email-masked]>, Sandelman Software Works  -= IPv6 IoT consulting =-

---

From: Michael Richardson <[email-masked]>
Date: Wed, 11 Dec 2019 14:00:46 -0500

> The information model doc is referenced in several places in the
    > architecture, but maybe it should be explicit about the threat model is
    > covered in detail in the information model document.

Thank you for this pointer.
I didn't think I'd find it in the info model, but in hindsight, it makes
sense.  It shows that I haven't paid enough attention to the information
model document. (Damn WG conflicts. I see it's in WGLC, which I had spaced too)

I want to suggest a tweak to the abstract:

OLD:
   One component of such a firmware update is a concise and machine-
   processable meta-data document, or manifest, that describes the
   firmware image(s) and offers appropriate protection.  This document
   describes the information that must be present in the manifest.

NEW:
   One component of such a firmware update is a concise and machine-
   processable meta-data document, or manifest, that describes the
   firmware image(s) and offers appropriate protection.  This document
   describes a series of security threats, along with the types of
   information that must be present in the manifest in order to deal
   with the threats.

---

From: Dave Thaler <[email-masked]>
Date: Wed, 11 Dec 2019 19:02:49 +0000

I agree with your suggestion.

Dave

-----Original Message-----
From: Suit <[email-masked]> On Behalf Of Michael Richardson
Sent: Wednesday, December 11, 2019 11:01 AM
To: [email-masked]
Subject: Re: [Suit] intentional rollback of firmware

Dave Thaler <[email-masked]> wrote:
    > https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdraft-ietf-suit-information-model-04%23section-4.3.1&amp;data=02%7C01%7Cdthaler%40microsoft.com%7C8da182acd4f042b83d0308d77e6c7328%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637116876569903627&amp;sdata=4yKFRvergdIPAGoZt9zSXNBhP%2BxSlPRRDUpUH%2FOfYR0%3D&amp;reserved=0 says:

Thank you for this pointer.
I didn't think I'd find it in the info model, but in hindsight, it makes sense.  It shows that I haven't paid enough attention to the information model document. (Damn WG conflicts. I see it's in WGLC, which I had spaced too)

OLD:

NEW: