Re: [IPP] IPP Firmware Update Extensions v1.0 - recommendations for "Security and Privacy" and "Implementation Considerations" sections
"Kennedy, Smith (Wireless & IPP Standards) via ipp" <ipp@pwg.org> Tue, 30 June 2026 21:24 UTC
Received: by mail2.ietf.org (Postfix) id 1357710B253BA; Tue, 30 Jun 2026 14:24:12 -0700 (PDT)
Delivered-To: ietfarch-ipp-archive@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 0454A10B253B9 for <ietfarch-ipp-archive@mail2.ietf.org>; Tue, 30 Jun 2026 14:24:12 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1782854652; bh=JKJFkRDkHwy39dyyh623zkmaCC4temLphK65i7+jWe4=; h=To:Date:References:In-Reply-To:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc; b=p6+KlePCrF01OJ7lZVv9Rck3ZqspoaWbQoABv4bR/wa6T58NSl7XNoshnWz56/od7 U3ipr/sHh8XRQKGjNK3m+eOtcUV23O0gIi28EAyKF6DR0/B460ozlQVxMfTe84pbVg RKCgUgap0ppXlq7H5Xx0xuOYdwp1tQ2uerqqRpUc=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.997
X-Spam-Level:
X-Spam-Status: No, score=-2.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, MAILING_LIST_MULTI=-1, MIME_HTML_MOSTLY=0.1, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_FAIL=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1024-bit key) header.d=pwg.org header.b="l6j7CGTJ"; dkim=pass (1024-bit key) header.d=pwg.org header.b="bF5nbB7y"; dkim=fail (2048-bit key) reason="fail (message has been altered)" header.d=hp.com header.b="OSJU0dIG"
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NWmsLua9MA_s for <ietfarch-ipp-archive@mail2.ietf.org>; Tue, 30 Jun 2026 14:24:11 -0700 (PDT)
Received: from mail.pwg.org (mail.pwg.org [172.104.19.21]) by mail2.ietf.org (Postfix) with ESMTP id 35B3210B253B0 for <ipp-archive2@ietf.org>; Tue, 30 Jun 2026 14:24:11 -0700 (PDT)
Received: by mail.pwg.org (Postfix, from userid 1002) id 4A6F0E904; Tue, 30 Jun 2026 21:24:05 +0000 (UTC)
DKIM-Filter: OpenDKIM Filter v2.11.0 mail.pwg.org 4A6F0E904
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=pwg.org; s=default; t=1782854645; bh=JKJFkRDkHwy39dyyh623zkmaCC4temLphK65i7+jWe4=; h=To:Date:References:In-Reply-To:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=l6j7CGTJRJ0GDzTTQ3vMMzfFlER0w5WVPxMg4o6gl3kYU/pZ7M9HCjInfH7G9B7kw hmyvhpGKRow+3m1Sfylh6VIYHyVGWlfXO2I3ajrp+/uG1xMB7avirYEjExBnvV0tnE zmYN1rcexFdmUgPkzd4dffqJIgixqyR966CLGcIc=
Received: from mail.pwg.org (localhost [IPv6:::1]) by mail.pwg.org (Postfix) with ESMTP id 6D9D02605; Tue, 30 Jun 2026 21:24:02 +0000 (UTC)
DKIM-Filter: OpenDKIM Filter v2.11.0 mail.pwg.org 6D9D02605
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=pwg.org; s=default; t=1782854642; bh=JKJFkRDkHwy39dyyh623zkmaCC4temLphK65i7+jWe4=; h=To:Date:References:In-Reply-To:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=bF5nbB7yeBbMciEX4kHzj5hf7U6/bLA7bipGGGUfsksEaa+YBM6r3tZAGyjMSsKBT nDe/mMM9yJTeNrmBDF3fY1387f8php2ifY/FpK0fZOhv0qCpRPCBnvJ/BDyE2CBMjb sM0F/oArPk4HATHqeJNzbc/9MvTOyqiHRqRxNfpg=
X-Original-To: ipp@pwg.org
Delivered-To: ipp@pwg.org
Received: by mail.pwg.org (Postfix, from userid 1002) id B4EA83A49; Tue, 30 Jun 2026 21:24:00 +0000 (UTC)
DKIM-Filter: OpenDKIM Filter v2.11.0 mail.pwg.org B4EA83A49
Authentication-Results: mail.pwg.org; dkim=pass (2048-bit key) header.d=hp.com header.i=@hp.com header.b="OSJU0dIG"
Received: from us-smtp-delivery-162.mimecast.com (us-smtp-delivery-162.mimecast.com [170.10.133.162]) by mail.pwg.org (Postfix) with ESMTPS id B8F193520 for <ipp@pwg.org>; Tue, 30 Jun 2026 21:23:56 +0000 (UTC)
DKIM-Filter: OpenDKIM Filter v2.11.0 mail.pwg.org B8F193520
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hp.com; s=mimecast20250822; t=1782854635; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=D5lBTdSG9ET90DdqbNGhxJxKMcuhfXL7Bd9SDistYFE=; b=OSJU0dIGaO+N7O2p4l0yeiTVvtls14UvbDpp1l9d3BUtLvF3EMC2RAuoSx04prCHUVaC4d iJxIb/4F6OAcilPWsm1VtW4hAPaN/OO9jQy3lqmrmyXN8GLA6AmH8kqhz/1qa0e7wvoYDU vfU3beU3v+z2eUmmmRKqQYhU1qRQBUBVkltASMY4aaVXgPMPQuCD03KTTSeW9QzSybl1WZ Ex4NbiGIS8LTVCRKJi2z5yX2h5wgS/wgLeyfe8d3C9C0vcWM0X2MKcgkR5CT5DEY32pAW/ F1j/SWmaQyzzHiHV+RTJsF3sIdZUGTM+z/IXc4X2+bhYEfxCOopWm8JEkrQRxw==
Received: from DM5PR21CU001.outbound.protection.outlook.com (mail-centralusazon11011034.outbound.protection.outlook.com [52.101.62.34]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-684-8IHFQR-JN4azuya-ezDIvg-1; Tue, 30 Jun 2026 17:23:52 -0400
X-MC-Unique: 8IHFQR-JN4azuya-ezDIvg-1
X-Mimecast-MFC-AGG-ID: 8IHFQR-JN4azuya-ezDIvg_1782854631
Received: from LV3PR84MB3820.NAMPRD84.PROD.OUTLOOK.COM (2603:10b6:408:1e3::7) by PH7PR84MB1583.NAMPRD84.PROD.OUTLOOK.COM (2603:10b6:510:152::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.8; Tue, 30 Jun 2026 21:23:47 +0000
Received: from LV3PR84MB3820.NAMPRD84.PROD.OUTLOOK.COM ([fe80::a360:dced:6096:5bbc]) by LV3PR84MB3820.NAMPRD84.PROD.OUTLOOK.COM ([fe80::a360:dced:6096:5bbc%3]) with mapi id 15.21.0181.008; Tue, 30 Jun 2026 21:23:47 +0000
To: Michael Sweet <msweet@msweet.org>
Thread-Topic: [IPP] IPP Firmware Update Extensions v1.0 - recommendations for "Security and Privacy" and "Implementation Considerations" sections
Thread-Index: AQHc6WDoqED2lp3u6k2xBpzrVslAF7YaEmaAgD3INQA=
Date: Tue, 30 Jun 2026 21:23:47 +0000
Message-ID: <3E568F50-2462-4CB4-B0DA-25A7E280792C@hp.com>
References: <EDAE9393-751B-4181-B4E4-BD3D62AFC719@hp.com> <741D07A8-C974-4A67-B757-BA198C12C9F7@msweet.org>
In-Reply-To: <741D07A8-C974-4A67-B757-BA198C12C9F7@msweet.org>
Accept-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-mailer: Apple Mail (2.3864.600.51.1.1)
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: LV3PR84MB3820:EE_|PH7PR84MB1583:EE_
x-ms-office365-filtering-correlation-id: e5749a0f-30ea-48fe-4479-08ded6eddf19
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0; ARA:13230040|19092799006|23010399003|366016|376014|1800799024|38070700021|4143699003|56012099006|22082099003|18002099003|8096899003
x-microsoft-antispam-message-info: Q/l9INFxQjlPsFXYVJVqCrLz0NJt+ryZT/K7wGeD/Ppa09W08NXm50GEwe5H5nBndhxw0nhQmc7pKdng51bF4lG26WRxiPQwMdODQuQ4yjLm/+4STtuT0BBUKzQ8XnwmC6tldWfuMrG1FIa0vmkZJQuO+jyK+sDnj2K/fg56DU3JolJ57Jk1tkRlRkENneltdNIFPHYI/C6bvd9L/Z1Q3QWqMmtoc4IqX2j9vcsdMNtg9a0avs5ybIVoyKwBOzhQWeiMHZcdrH7ee5LducJEggfVjUzhwRpVMC4tH9TJzqRwYGOtCadcJk2EFg8MSxgrwcRzKQjZVAZi6BhntFSw2Hpz0S+RDlxKBhybIdybPDrfXXT0ucEESdTtb/yCnPTmNK6DS/NPi4T8qWEC/K98yFPkI24pwO5gOyOn3qpKMRMC8tzw04IQk3FuXeMOGUEbIbTn+vo+KM3clHZvBzatZwt5FpW/csjErI3S0/jVtiMr5fmZWI6xiGENWQsxwTCPGFhSy7GrkfFdNcz19499IWA8n8Pq2R5LB4ex5PUV6sc2YvmTFcSF0OqpPAbm/1p+pa8ruCMn+CV+6x4iy+QJdKIRKSJwAEjf8fNeSIb64r/rNztpVWPOgohk2opHoPveVoCXKhV8EeyLNlfCrvvDihh8czb2RMgQa4wYGFfWYdsTNEnQdhUABEyEIanmVIStZJnMw91lGychX5DkH7GGmKosLxx8GQTOStqu27po9cI=
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:LV3PR84MB3820.NAMPRD84.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230040)(19092799006)(23010399003)(366016)(376014)(1800799024)(38070700021)(4143699003)(56012099006)(22082099003)(18002099003)(8096899003); DIR:OUT; SFP:1101
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: lilsQnxUqwXGaOPUupsQybjdZg2QXMptBGMH27RM6CoYejeFsIwiaF8GTixOy0NU4t0cYHqY96TO6EOu0GsWl6IVuRc5v48/d7QD6EnF0geVaJJGufMgw8nxigZkxEuFMwMJexdzHrbPyHxgiEjfyeiTILxwUZaRDU2q6zauKSJ+fhLPGcTHaswAFtkF32qkG/3NE8O4Mz8lnJwBon35UNVJUV50MueVp3Jku9V6W+GZ6Sq1zhY3qnvXf5OT5uvmQX5e3cOrL5hNWmLchF17hDMW1XGN7IpF7eoX3VvQo4dqVzYWDVB1qCFMa1TiTbTk4coeHJAyeJ1ookAe9LQ1b4jK0bQn5JLgHnnE/heAVnvT1Y+QVc5scDpzGt3Li+Kg4PjRd5mqnDndSzr8VgPKnx0JbwGIioDq/rbKJvSRjF0Fetm8FWpyVueAeNRp90Zc27ynCTh3DFggMW+kmOshvstHI1EcdCzaz1SckOOZVDoY3CD/14rKhSyYJNGfRcIH5YlEVqw+GNzIpol1nEdI1utQxwJeATV5WRRDgZD+X4w2KjGUD+EvPMGKXhCHzQnGLoWd6ekuC2cGHUk8yxo6WYRU9hA7+jEETxmOHXTeXWfUODKa9kNubhE61RsC9hMoUyOUjOYGuJyO2DjXYV/QXChQGa89DNAvJlA404K1omICSXOiBnIwfdpGpxtKdDsKqaw9+lNfZ7XFL4GsF/EkzIRlcohIHYHbhRSrsC+8FpLTmNDwx2Aj7hTYIkxdFwpM2IvHNFUJvIx2LN0rQw5Z8oZKQPFUPcnY2+7IxXaFb9zItLsgRRu/oAIOTG7k/GY58gklfBGq2vz8DcyMijiXqjmaD8/103yU4JFahFSNicbe7rf0EZjv8YuB4WsjPfRSlTvdITF6XaUgVSl54IsNWJQ4fi0DVx5e6Tt93e2DsTjrnzUlOgNCf8IxbZqy52A7qJej3D5HyPUFfgb6AJIkreNCOb1Qh8ZDAHouaspJg+yxfnTcoGJOvRzK5jVe1ZnuD83N741KEqHeTQPTlDdx3yWXLFwWY2TDFsspYNbHJInlClz8gtadZOAHJdnLVAj0IDBbvq16iTci7PI2dyf23jiYwGS9R6edJ0MGEuzQyBQPHpLlxCh+G78C0BiOA+Xsq53bBRQXmTEnDNV8iyXe8Bbh1DRIQ3UM7Gz4GNSgj7IlmictrOTDDAI+usTUuRjmWQl/dc6CLYUEjfeM5lrupVC1TFA+UVJcRMX6F7wU+QkartAWYgk87wOONXdtOtjuLo72dCRgLRHfEoF8pR516J6WhghFPY6d8WwaMbMUR+E0CK8dxHB6OEX0IIc+8puTkpKj9tjihFbRym9KxJiRZGngQCXq4R4XIYKbwQCHWc3GthbfZNvo4mLG0zI4Ct3PqBPADtLECC0QHCFhc+PiBZHZsRclzrBRZlSwS8lm3LgYtlg97GRTjmBU8BRjDZ7uolhxk4s1km9IJtFM6jlBAvqgM99ZUQ+SMPK6sCMKIkXpLmDoGsrx04op/EobZVMzosOQW7uYFM0qycMHiujQ1jKIl9uY1PjUYGDP2RUIRShyIgPc4N7Lcq/7eB8GY55V4GbU5HUmB8qREGS8vZcvBTDM3oXGDfJ4QzapVKH/GwX/CYttnb4HJr7I+McVpTrkYQUPEOzl+qWnqQMM/8G+QVdrSptK/pMpnhWK7XGxxHfDfESROZpWOWChfFjhQgxwMOwYggqpQKlv4urr+WlUew==
MIME-Version: 1.0
X-Exchange-RoutingPolicyChecked: nwm66I7MC6YffgcAojOiid+gx1k/lzINgibf9WBv+/li8DiLm+KREmCex/YN9VuyYciGengCvSTPcKCZjtuVUgixp1iKsqLtQy/uJS64Abs0TWRmuwM+fap2ifbWHRcPEWIhEYrF46S2/S/5+rrfXsT2tcS3UYw3BzZrkjoJMZpwHIAcdxrseCfpTzRIdAjMg5DUd6E/so03L3BFfqEa8x4+NzylGvxqatvj3qNUZLTk3DtXP9KQIZnU5xQhtnz9fTL+1v1TzpRUHWQxa/swEAzwg/9iCL7rcvK+iTkUuYa+BiQGJYhsM2ZliWv+EHKXqM5qUfOafROk5DFfc1etYg==
X-OriginatorOrg: hp.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: LV3PR84MB3820.NAMPRD84.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: e5749a0f-30ea-48fe-4479-08ded6eddf19
X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jun 2026 21:23:47.1128 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: ca7981a2-785a-463d-b82a-3db87dfc3ce6
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: zirSpKuS5TWAmJ7X++rD+zSEC3L5z7YFwIe/mBk4HT1qjjRf6H/18DRudqJn9zNDfdAkieOUo3i2QyO8x5SMbg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR84MB1583
X-Mimecast-Spam-Score: 0
X-Mimecast-MFC-PROC-ID: J9aGEL3qpdNhesauojA4mkM3IMpTYJ-F3emzmm7yf0M_1782854631
X-Mimecast-Originator: hp.com
Content-Language: en-US
Subject: Re: [IPP] IPP Firmware Update Extensions v1.0 - recommendations for "Security and Privacy" and "Implementation Considerations" sections
X-BeenThere: ipp@pwg.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: ISTO-PWG Internet Printing Protocol workgroup discussion forum <ipp.pwg.org>
List-Unsubscribe: <https://www.pwg.org/mailman/options/ipp>, <mailto:ipp-request@pwg.org?subject=unsubscribe>
List-Archive: <http://www.pwg.org/pipermail/ipp/>
List-Post: <mailto:ipp@pwg.org>
List-Help: <mailto:ipp-request@pwg.org?subject=help>
List-Subscribe: <https://www.pwg.org/mailman/listinfo/ipp>, <mailto:ipp-request@pwg.org?subject=subscribe>
From: "Kennedy, Smith (Wireless & IPP Standards) via ipp" <ipp@pwg.org>
Reply-To: ISTO-PWG Internet Printing Protocol workgroup discussion forum <ipp@pwg.org>
Cc: "Kennedy, Smith (Wireless & IPP Standards)" <smith.kennedy@hp.com>, ISTO-PWG Internet Printing Protocol workgroup discussion forum <ipp@pwg.org>
Content-Type: multipart/mixed; boundary="===============8919622724591745863=="
Errors-To: ipp-bounces@pwg.org
Sender: ipp <ipp-bounces@pwg.org>
Thanks Mike! I've tried to incorporate these into section 10 of the next draft, which should be posted in time to review it in 2 weeks.
Cheers,
Smith
/**
Smith Kennedy
HP Inc.
*/
On May 22, 2026, at 7:54 AM, Michael Sweet <msweet@msweet.org> wrote:
CAUTION: External Email
Smith,
Some thoughts on security/privacy:
1. Firmware should be cryptographically signed
2. Firmware downloads should be protected in transit (i.e. HTTPS/TLS)
3. Any identifiers used to authorize access to and/or track downloads and installations of new firmware should be limited to the Printer and not the Printer's owner, organization, etc. IOW, "this is a valid Example Corp Laser Printer 2000 with SN 12345 that is entitled to receive firmware v2.0" - this allows the vendor to broadly know what version(s) of firmware are in use, whether there have been issues installing new firmware, etc. but not to know that Alice hasn't updated the firmware in her Printer for the last 18 months.
4. Firmware Repositories can potentially combine Printer identity information with IP addresses, routing info, etc. to determine the identity of owners (privacy consideration for using OTA updates...)
I know we don't want to dig too deep with this, and I certainly don't want to provide a roadmap for abusing OTA updates, but it seems appropriate to outline some of the risks and highlight best practices...
On May 21, 2026, at 4:32 PM, Kennedy, Smith (Wireless & IPP Standards) via ipp <ipp@pwg.org<mailto:ipp@pwg.org>> wrote:
Hi there,
For IPP Firmware Update Extensions v1.0, does anybody have any recommendations for items to list in the "Security and Privacy" and "Implementation Considerations" sections? I'd like to get that before I produce my next draft, which will be ready for our IPP WG meeting June 18.
Cheers,
Smith
/**
Smith Kennedy
HP Inc.
*/
_______________________________________________
ipp mailing list
ipp@pwg.org
https://www.pwg.org/mailman/listinfo/ipp
________________________
Michael Sweet
_______________________________________________ ipp mailing list ipp@pwg.org https://www.pwg.org/mailman/listinfo/ipp
- [IPP] IPP Firmware Update Extensions v1.0 - recom… Kennedy, Smith (Wireless & IPP Standards) via ipp
- Re: [IPP] IPP Firmware Update Extensions v1.0 - r… Michael Sweet via ipp
- Re: [IPP] IPP Firmware Update Extensions v1.0 - r… Ira McDonald via ipp
- Re: [IPP] IPP Firmware Update Extensions v1.0 - r… wamwagner--- via ipp
- Re: [IPP] IPP Firmware Update Extensions v1.0 - r… Kennedy, Smith (Wireless & IPP Standards) via ipp
- Re: [IPP] IPP Firmware Update Extensions v1.0 - r… Kennedy, Smith (Wireless & IPP Standards) via ipp
- Re: [IPP] IPP Firmware Update Extensions v1.0 - r… Kennedy, Smith (Wireless & IPP Standards) via ipp
- Re: [IPP] IPP Firmware Update Extensions v1.0 - r… wamwagner--- via ipp
- Re: [IPP] IPP Firmware Update Extensions v1.0 - r… Michael Sweet via ipp