Re: [Iotops] can we create protocols that securely transfer ownership?

On Sun, Nov 01, 2020 at 11:00:28AM -0500, Michael Richardson wrote:
> While there is an issue of how to maintain software beyond the lifetime of
> the (interest of the marketing department) of the manufacturer, the bigger
> picture is that the device is cryptographically locked to running on software
> approved (digitally signed) by the manufacturer.
> 
> We actually *need* this kind of lockdown in order to keep malware out.
> But, one person's weed is another person's wild-flower.

Many ways to cut the cake:

IMHO, devices MUST permit to override TA for secure boot/software with
owner TA, so i can securely allow for it to only run software i as the
owner sign. And those TA ultimately would be what identifies the owner.
More so, then any certificate (because the TA designate who can do something
with the device).

In addition, i would want vouchers that sign with my own TA the cert
of a vendor signed piece of software, so i can install such software.

Most classical use-case: Do not permit arbitrary staff to install
random vendor software versions, but only those that have been verified
and approved by some testing department. And those vouchers might
be short-lived, so that installation can only happen in a time window
before a likely better updated software version would be preferrable.
Or later downgrade without permission.

> Having the hexdump doesn't help us much.  We basically already have that.
> Often we have the entire source code, but we still can't load it into the
> device because we don't have the keys that are baked (literally: by laser
> blown fuses into the silicon) into the device.

Laser blown fuses sounds expensive. We had OTP memory forever.

Cheers
    Toerless
> --
> Michael Richardson <mcr+IETF@sandelman.ca>   . o O ( IPv6 IøT consulting )
>            Sandelman Software Works Inc, Ottawa and Worldwide

> -- 
> Iotops mailing list
> Iotops@ietf.org
> https://www.ietf.org/mailman/listinfo/iotops

-- 
---
tte@cs.fau.de