Subject: Re: [Suit] SUIT rechartering: proposed text

From: Dave Thaler <[email-masked]>
Date: Mon, 2 Aug 2021 21:34:39 +0000

This addresses my comments, so looks fine to me.

Dave

-----Original Message-----
From: Suit <[email-masked]> On Behalf Of Russ Housley
Sent: Saturday, July 31, 2021 1:57 PM
To: suit <[email-masked]>
Subject: Re: [Suit] SUIT rechartering: proposed text

Based on the discussion at IETF 111, I have updated the DRAFT re-charter text.

Please review and comment.

Russ

= = = = = = =

Vulnerabilities in Internet of Things (IoT) devices have raised the need for a secure firmware update mechanism that is also suitable for constrained devices.  Security experts, researchers, and regulators recommend that all IoT devices be equipped with such a mechanism.  While there are many proprietary firmware update mechanisms in use today, there is no modern interoperable approach allowing secure updates to firmware in IoT devices. In June 2016, the Internet Architecture Board organized a workshop on 'Internet of Things (IoT) Software Update (IOTSU)', and RFC 8240 documents various requirements and challenges that are specific to IoT devices.

A firmware update solution consists of several components, including:
* A mechanism to transport firmware images to compatible devices.
* A manifest that provides meta-data about the firmware image (such as a
  firmware package identifier, the hardware the package needs to run, and
  dependencies on other firmware packages), as well as cryptographic
  information for protecting the firmware image in an end-to-end fashion.
* The firmware image itself.

The SUIT WG is defining a firmware update solution (taking into account past learnings from RFC 4108 and other proprietary firmware update solutions) that are usable on Class 1 (as defined in RFC 7228) devices, i.e., devices with
~10 KiB RAM and ~100 KiB flash.  The solution may apply to more capable devices as well.  The SUIT WG is not defining any new transport or discovery mechanisms, but may describe how to use existing mechanisms within the architecture.

The SUIT WG has already completed work on two documents:
* An IoT firmware update architecture.
* An information model for the SUIT manifest.

Now that the information model is complete, the SUIT WG has selected the CBOR serialization format and the associated COSE cryptographic mechanisms to encode the SUIT manifest. The SUIT WG may consider a small number of additional formats in the future; however, to reduce the complexity of a firmware management solution, a very small number of formats is preferred to enable SUIT maifest integration and interoperability with other IoT technologies and ecosystems.  To support a wide range of deployment scenarios, the formats are expected to be expressive enough to allow the use of different firmware sources and permission models.

The SUIT WG does not aim to create a standard for a generic application software update mechanism, but instead the SUIT WG is focusing on firmware development practices in the embedded industry. Software update solutions that target updating software other than the firmware binaries (e.g., applications) are also out of scope.

To support the SUIT manifest format, the SUIT WG is also defining formats that enable a SUIT Status Tracker to determine if a particular manifest could be successfully deployed to a device and determine if an operation was successful.

In addition, the SUIT WG will work with the RATS WG to specify claims related to the SUIT Status Tracker that can be used to provide evidence in support of the architecture that has already been defined by the RATS WG.

The SUIT WG will continue to work with silicon vendors and OEMs that develop IoT operating systems to produce implementations based on SUIT WG specifications.  In particular, the SUIT WG plans to continue to participate in IETF Hackathons.

The SUIT WG document deliverables are:
* A SUIT manifest format specification using CBOR.
* Extensions to the SUIT manifest for optional capabilities, including
  firmware encryption.
* A secure method for an IoT device to report on firmware update status.
* A SUIT manifest extension to include a MUD file as defined in RFC 8520.

In addition, either the SUIT WG or the RATS WG will produce:
* A set of claims for attesting to firmware update status.

_______________________________________________
Suit mailing list
[email-masked]
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsuit&amp;data=04%7C01%7Cdthaler%40microsoft.com%7C427385012603490935f008d95465c81f%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637633618399989057%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=7R1HMSFRyHq6792Rd84LOVQTWu6lNjk2mQRpR7odSPs%3D&amp;reserved=0

---

From: Russ Housley <[email-masked]>
Date: Thu, 5 Aug 2021 17:09:40 -0400

It has been several days without further comment.  Please speak up if this text needs further tweaks before being proposed to the IESG.

Russ

> On Aug 2, 2021, at 5:34 PM, Dave Thaler <[email-masked]> wrote:
>

---

From: Brendan Moran <[email-masked]>
Date: Tue, 10 Aug 2021 09:04:11 +0000

>> The SUIT WG does not aim to create a standard for a generic application software update mechanism, but instead the SUIT WG is focusing on firmware development practices in the embedded industry. S…

This is a concern because, in the manifest format, we say that the primary goal is firmware update, but it’s still usable for software update. If this paragraph of the charter remains as-is, then the manifest format appears to go counter to the charter. I would argue that this paragraph appears to prohibit the development of support for TEEP.

Should we consider alternate phrasing?

Best Regards,
Brendan

> On 5 Aug 2021, at 22:09, Russ Housley <[email-masked]> wrote:
>
> https://www.ietf.org/mailman/listinfo/suit

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Russ Housley <[email-masked]>
Date: Tue, 10 Aug 2021 09:37:07 -0400

> On Aug 10, 2021, at 5:04 AM, Brendan Moran <[email-masked]> wrote:
> 

This is largely unchanged from the current charter, which says:

This group does not aim to create a standard for a generic application software
update mechanism, but instead this group will focus on firmware development
practices in the embedded industry. Software update solutions that target
updating software other than the firmware binaries (e.g., applications) are
also out of scope.

I do not think SUIT manifest is counter to this paragraph.  It makes no attempt to replace Windows software update or the Red Hat Update Agent to name two among many.

That said, can suggest alternate text that more accurately scopes the firmware update effort?

Russ

---

From: Michael Richardson <[email-masked]>
Date: Tue, 10 Aug 2021 12:14:47 -0400

>>> The SUIT WG does not aim to create a standard for a generic
    >>> application software update mechanism, but instead the SUIT WG is
    >>> focusing on firmware development practices in the embedded
    >>> industry. Software update solutions that target updating software
    >>> other than the firmware binaries (e.g., applications) are also out of
    >>> scope.

    > This is a concern because, in the manifest format, we say that the
    > primary goal is firmware update, but it’s still usable for software
    > update. If this paragraph of the charter remains as-is, then the
    > manifest format appears to go counter to the charter. I would argue
    > that this paragraph appears to prohibit the development of support for
    > TEEP.

We weren't aiming for software update, but it turns out that we hit the mark.

The paragraph, as Russ says, is left over from before.
The important part about it is that if SUIT Manifest format was found lacking
in some way as a "generic application software update", that wouldn't be considered a bug.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Ira McDonald <[email-masked]>
Date: Tue, 10 Aug 2021 12:30:04 -0400

Hi,

I suggest that SUIT indeed has potentially much wider utility
than just the initial firmware of an embedded device.

Without displacing other vendor and consortia based software
update solutions, I suggest that SUIT could be used to update
software modules (after initial firmware) in a target device.

Having spent the last two years as a US invited expert in the
ISO 24089 Road Vehicles: Software Update project and the
last eight years addressing OTA firmware/software update
for the automotive industry, I suggest that SUIT has quite a
few advantages over many of the other solutions that were
adapted from the mobile phone industry.

I believe that it would be unfortunate for the SUIT charter to
imply or explicitly say that it's not suitable for the automotive
industry.

Cheers,
- Ira

---

From: Dave Thaler <[email-masked]>
Date: Tue, 10 Aug 2021 16:33:57 +0000

I agree with Brendan, etc.
Maybe we should simply remove the paragraph and remain silent.

Dave

From: Suit <[email-masked]> On Behalf Of Ira McDonald
Sent: Tuesday, August 10, 2021 9:30 AM
To: Michael Richardson <[email-masked]>; Ira McDonald <[email-masked]>
Cc: suit <[email-masked]>; Brendan Moran <[email-masked]>
Subject: Re: [Suit] SUIT rechartering: proposed text

Hi,

Cheers,
- Ira

On Tue, Aug 10, 2021 at 12:16 PM Michael Richardson <[email-masked]<mailto:[email-masked]>> wrote:

Brendan Moran <[email-masked]<mailto:[email-masked]>> wrote:
    > I'm slightly concerned by one paragraph:

    > primary goal is firmware update, but it's still usable for software

--
Michael Richardson <[email-masked]<mailto:[email-masked]>>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

_______________________________________________
Suit mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/suit<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsuit&data=04%7C01%7Cdthaler%40microsoft.com%7Cf2c973072f7d459050b808d95c1c6604%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642099315360855%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=INYmiKpX8DUroLOGBG9y9K2RMJc%2B%2Bk9hbWTQRqInFUA%3D&reserved=0>

---

From: Russ Housley <[email-masked]>
Date: Tue, 10 Aug 2021 12:38:12 -0400

Okay, I dropped that paragraph.

Any other comments from anyone?

Russ

> On Aug 10, 2021, at 12:33 PM, Dave Thaler <dthaler=[email-masked]> wrote:
> 
> From: Suit <[email-masked] <mailto:[email-masked]>> On Behalf Of Ira McDonald
> To: Michael Richardson <[email-masked] <mailto:[email-masked]>>; Ira McDonald <[email-masked] <mailto:[email-masked]>>
> Cc: suit <[email-masked] <mailto:[email-masked]>>; Brendan Moran <[email-masked] <mailto:[email-masked]>>
> On Tue, Aug 10, 2021 at 12:16 PM Michael Richardson <[email-masked] <mailto:[email-masked]>> wrote:
> 
> Brendan Moran <[email-masked] <mailto:[email-masked]>> wrote:
> Michael Richardson <[email-masked] <mailto:[email-masked]>>   . o O ( IPv6 IøT consulting )
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/suit <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsuit&data=04%7C01%7Cdthaler%40microsoft.com%7Cf2c973072f7d459050b808d95c1c6604%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637642099315360855%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=INYmiKpX8DUroLOGBG9y9K2RMJc%2B%2Bk9hbWTQRqInFUA%3D&reserved=0>_______________________________________________
> Suit mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/suit <https://www.ietf.org/mailman/listinfo/suit>