Re: [Iotops] can we create protocols that securely transfer ownership?

[Michael Richardson <[e-mail]>]

William_J_G Overington <wjgo_10009=[e-mail]> wrote:
    > I am wondering if the issue of being able to recover the original software
    > for a thing could be solved by some infrastructure something like it being
    > good practice for the manufacturer of the thing to produce a hexadecimal dump
    > of the software and publish it in a PDF (Portable Document Format) document
    > and for that PDF document to be deposited at The British Library in
    > accordance with the legal deposit regulations together with a note permitting
    > The British Library to supply a copy to anyone for a fee. The document could
    > also be made available on the manufacturer's website, yet legal deposit at
    > The British Library would mean that the document would still be available
    > even if the manufacturer went out of business and the website was no longer
    > available.

While there is an issue of how to maintain software beyond the lifetime of
the (interest of the marketing department) of the manufacturer, the bigger
picture is that the device is cryptographically locked to running on software
approved (digitally signed) by the manufacturer.

We actually *need* this kind of lockdown in order to keep malware out.
But, one person's weed is another person's wild-flower.

Having the hexdump doesn't help us much.  We basically already have that.
Often we have the entire source code, but we still can't load it into the
device because we don't have the keys that are baked (literally: by laser
blown fuses into the silicon) into the device.

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide