Re: WG Review: Software Updates for Internet of Things (suit)

[IESG Secretary <[e-mail]>]

The draft charter for the proposed Software Updates for Internet of 
Things (suit) WG underwent a few revisions during the external review 
process. The current version of the charter is -09, below. The charter 
is on the IESG agenda for 2017-12-14.

--

charter-ietf-suit-00-09

Vulnerabilities in Internet of Things (IoT) devices have raised the need
for a secure firmware update mechanism that is also suitable for 
constrained devices.  Security experts, researchers, and regulators 
recommend that all IoT devices be equipped with such a mechanism.  While 
there are many proprietary firmware update mechanisms in use today, 
there is a lack of a modern interoperable approach of securely updating 
the firmware in IoT devices. In June of 2016 the Internet Architecture 
Board organized a workshop on 'Internet of Things (IoT) Software Update 
(IOTSU)', and RFC 8240 documents various requirements and challenges 
that are specific to IoT devices.

A firmware update solution consists of several components, including:
* A mechanism to transport firmware images to compatible devices.
* A manifest that provides meta-data about the firmware image (such as a
firmware package identifier, the hardware the package needs to run, and
dependencies on other firmware packages), as well as cryptographic 
information for protecting the firmware image in an end-to-end fashion. 
* The firmware image itself.

This group will focus on defining a firmware update solution (taking 
into account past learnings from RFC 4108 and other firmware update 
solutions) that will be usable on Class 1 (as defined in RFC 7228) 
devices, i.e., devices with ~10 KiB RAM and ~100 KiB flash.  The 
solution may apply to more capable devices as well.  This group will not 
define any new transport or discovery mechanisms, but may describe how 
to use existing mechanisms within the architecture.

In particular this group aims to publish several documents, namely:
* An IoT firmware update architecture that includes a description of the
involved entities, security threats, and assumptions. 
* One or more manifest format specifications.

The initial focus of this group will be development of the information 
model for the contents of a manifest. Once there is general agreement on 
the contents, the group will pick a small number of serialization 
formats such as CBOR and/or ASN.1 (and their associated cryptographic 
mechanisms) to encode the manifest. A small number of formats is 
preferred to reduce the complexity of a firmware management solution, 
where each IoT device would typically only support one format, but the 
same tool or service might support all such formats. To support a wide 
range of deployment scenarios, the formats are expected to be expressive 
enough to allow the use of different firmware sources and permission 
models.

This group does not aim to create a standard for a generic application 
software update mechanism, but instead this group will focus on firmware 
development practices in the embedded industry. Software update 
solutions that target updating software other than the firmware binaries 
(e.g., applications) are also out of scope.

This group will aim to maintain a close relationship with silicon 
vendors and OEMs that develop IoT operating systems.

Proposed milestones

Date 		Milestone
Nov 2018 	Submit an initial manifest serialization format to the 
		IESG for publication as a Proposed Standard.
Jul 2018 	Submit manifest information model to the IESG for 
		publication as Informational.
Jul 2018 	Calendar item: Second interoperability event at IETF 
		102.
Mar 2018 	Adopt initial manifest serialization format(s) as WG 
		item(s).
Mar 2018 	Calendar item: First interoperability event at IETF 101.
Mar 2018 	Adopt a manifest information model as a WG item.
Jan 2018 	Adopt "Architecture" document as WG item. 


On Nov 3, 2017, at 9:32 AM, The IESG <[e-mail]> wrote:

> The Software Updates for Internet of Things (suit) WG in the Security 
> Area of the IETF is undergoing rechartering. The IESG has not made any 
> determination yet. The following draft charter was submitted, and is 
> provided for informational purposes only. Please send your comments to 
> the IESG mailing list ([e-mail]) by 2017-11-13.
> 
> Software Updates for Internet of Things (suit)
> ----------------------------------------------------------------------
> Current status: BOF WG
> 
> Chairs:
>  Dave Thaler <[e-mail]>
>  David Waltermire <[e-mail]>
>  Russ Housley <[e-mail]>
> 
> Assigned Area Director:
>  Kathleen Moriarty <[e-mail]>
> 
> Security Area Directors:
>  Kathleen Moriarty <[e-mail]>
>  Eric Rescorla <[e-mail]>
> 
> Mailing list:
>  Address: [e-mail]
>  To subscribe: https://www.ietf.org/mailman/listinfo/suit
>  Archive: https://mailarchive.ietf.org/arch/search/?email_list=suit
> 
> Group page: https://datatracker.ietf.org/group/suit/
> 
> Charter: https://datatracker.ietf.org/doc/charter-ietf-suit/