Re: [Fud] FUD BarBOF Location

[Michael Richardson <[e-mail]>]

Carsten Bormann <[e-mail]> wrote:
    > — firmware updates for general purpose class computers (Linux etc.,
    > “A-class”, OpenWRT routers, ...) are rather different from those for
    > microcontrollers (“M-class”)

well, Hannes kept saying that, and a number of us kept saying that in fact
it wasn't true.   Writing a 1GB image onto a 1.1GB NAND boot partition
could be as difficult to get right as writing a 31K image into a 32K NAND
partition.  The only difference being what you can fit in the "extra" space.
(100M of bootloader space vs 1K of bootloader space...)

OpenWRT routers and Smartphone updates are very much closer to M-class than
they are to "Linux" desktops. It's a signed blob, and often there isn't space
to double buffer it at all.

If it is useful for me to write up my minimal (D)TLS receiver concept for
firmware updates, I will do that.

    > — we should probably look specifically at the latter

Agreed.

    > — initial focus on complete firmware replacement (we did talk about
    > bootloaders vs. primary/recovery loaders etc.)

    > — the next step could be defining what set of metadata should be
    > provided for a such a firmware image
    > — RFC 4108 is out there but may not exactly be what is needed for M-class today
    > — coswid (no, not the Trojan horse) might be one format to look at

I think that we should consider updates to 4108.
If we don't like 4108, then we should consider a non-ASN1, non-PKIX format
format (JOSE for instance).


--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-