Subject: [Suit] Boot vs. Invocation

From: Brendan Moran <[email-masked]>
Date: Mon, 3 Aug 2020 11:01:43 +0000

In response to some of Dave T’s comments (specifically, [DT32]) I would like to propose replacing instances of “boot” with “invocation” so that "secure boot" becomes “secure invocation.” This is to make it clearer that SUIT manifests are appropriate for invoking TAs for TEEP. Booting an IoT device securely and running a TA securely are both classes of secure invocation and Dave has raised that it is not obvious that SUIT manifests are appropriate for both.

Best Regards,
Brendan

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Henk Birkholz <[email-masked]>
Date: Mon, 3 Aug 2020 13:06:09 +0200

Hi Brendan,

sounds like a quite targeted way forward (you all know what comes 
next...). We just have to make sure that this tweak is captured well 
prominently in the text, as a definition, so it can be referenced in a 
meaningful manner and reflects the superset of "authenticated boot" and 
"authenticated TA invocation" well.

Cheers,

Henk

On 03.08.20 13:01, Brendan Moran wrote:
> _______________________________________________
> Suit mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/suit
>

---

From: Brendan Moran <[email-masked]>
Date: Mon, 3 Aug 2020 12:38:16 +0000

Hi Henk,

As it happens, there was already a definition for “trusted execution,” unused in the specification, that defines itself as a superset of boot & run. I could replace it with Trusted Invocation, and that would provide the definition you would like.

Brendan

> On 3 Aug 2020, at 12:06, Henk Birkholz <[email-masked]> wrote:
>
> Hi Brendan,
>
> sounds like a quite targeted way forward (you all know what comes next...). We just have to make sure that this tweak is captured well prominently in the text, as a definition, so it can be referenced in a meaningful manner and reflects the superset of "authenticated boot" and "authenticated TA invocation" well.
>
> Cheers,
>
> Henk
>

---

From: Michael Richardson <[email-masked]>
Date: Mon, 03 Aug 2020 15:32:38 -0400

Brendan Moran <[email-masked]> wrote:
    > In response to some of Dave T’s comments (specifically, [DT32]) I would
    > like to propose replacing instances of “boot” with “invocation” so that
    > "secure boot" becomes “secure invocation.” This is to make it clearer

I think that "secure invocation" is a bit jarring to the ear... more awkward to read, but I don't object.
Are there any other possible words?

. o O ( KMAC(wingardim levioso!) )

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-