Subject: [Suit] draft-ietf-suit-firmware-encryption: HPKE for COSE

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 2 Aug 2021 15:08:44 +0000

Hi all,

Currently we have newly introduced the use of HPKE for COSE in the firmware encryption draft.

HPKE could, however, be useful for other applications using COSE as well.

So, the question is: Should the HPKE functionality be defined separately for use with COSE or be defined specifically for use with firmware encryption only?

The answer to this question is a bit speculative because we have to guess whether HPKE will be useful for other applications using COSE. Currently, HPKE is used in various IETF protocols (MLS, TLS Encrypted ClientHello, Privacypass) but none of those applications utilize COSE.

Thoughts?

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Russ Housley <[email-masked]>
Date: Mon, 2 Aug 2021 11:20:05 -0400

I strongly suspect that HPKE will be useful in non-SUIT applications, so I would like to approach COSE about the best way to move forward.

Russ

> On Aug 2, 2021, at 11:08 AM, Hannes Tschofenig <[email-masked]> wrote:
> 
> Hi all, 
>  
> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. _______________________________________________
> Suit mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/suit <https://www.ietf.org/mailman/listinfo/suit>

---

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 16 Aug 2021 09:44:29 -0700

> The answer to this question is a bit speculative because we have to guess whether HPKE will be useful for other applications using COSE. Currently, HPKE is used in various IETF protocols (MLS, TLS…

Chiming in super-late, but I agree with Russ about raising this with COSE.

-Ben

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 17 Aug 2021 05:16:15 +0000

FWIW I also agree that this is the right decision because HPKE isn't specific to firmware updates.

-----Original Message-----
From: Benjamin Kaduk <[email-masked]>
Sent: Monday, August 16, 2021 6:44 PM
To: Hannes Tschofenig <[email-masked]>
Cc: [email-masked]
Subject: Re: [Suit] draft-ietf-suit-firmware-encryption: HPKE for COSE

-Ben