Re: [Rats] [sacm] CoSWID and EAT and CWT

Ah!

Yes, updating a Trusted Application in a TEE is way way easier than 
updating an "early stage boot loaders and the image signing systems".

I also totally agree with that. Somehow my point of view came from the 
other side around.

But the same is true for creating EAT, right? Or is it easier for "early 
stage boot loaders and the image signing systems" to create EAT than to 
process SUIT. I think that is intended to be the conclusion here, if I 
am not mistaken, but I do not yet understand why that is the case.

Viele Grüße,

Henk

On 28.11.19 12:39, Adrian Shaw wrote:
> Hi Henk,
> 
> The scenario that Michael described was one I had in mind. It is much easier to update a TA or a TEE to support EAT on an existing system than it is to update the early stage boot loaders and the image signing systems in order to support SUIT.
> 
> Glad that you somewhat agree :-)
> 
> Adrian
> 
>> On 28 Nov 2019, at 08:40, Henk Birkholz <henk.birkholz@sit.fraunhofer.de> wrote:
>>
>> I am not convinced that the gap is as big as illustrated.
>>
>> Maybe because I need a use case description why the "boot/recovery roms" are already creating EAT and not a software component running in the TEE.
>>
>> Creating Measurements & Creating EAT are not tightly coupled time-wise, is my assumption today, for example in a cell-phone, I'd assume today.
>>
>> I am in full agreement, that the entire SUIT Manifest would be over-kill in the stages "boot/recovery roms". Although, I know of recovery roms that do exactly that: retrieving a SUTI Manifest including firmware to do... well recovery.
>>
>> Viele Grüße,
>>
>> Henk
>>
>> On 28.11.19 09:23, Michael Richardson wrote:
>>> Henk Birkholz <henk.birkholz@sit.fraunhofer.de> wrote:
>>>      > to your first point: I am not sure what legacy systems that would be able to
>>>      > create/process EAT would not be able to process a SUIT manifest. Could you
>>>      > elaborate on that?
>>> I think that an example is in your hand, a smartphone.
>>> I think that their boot/recovery roms do not process SUIT today, but it would
>>> be possible to generate measurements in EAT format as to what is running
>>> if the measurements are available.
>>>      > I'd maybe not call that a dependency, but rather synergy
>>>      > in data models, but I am under the suspicion that I simply don't understand
>>>      > the scenario that you are talking about.
>>> I think that the synnergy makes sense to me.
>>> Just because we describe what is running using SUIT terminology and
>>> constructs does not mean that we have use the entire Manifest.
>>> --
>>> Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
>>>   -= IPv6 IoT consulting =-
>>> _______________________________________________
>>> RATS mailing list
>>> RATS@ietf.org
>>> https://www.ietf.org/mailman/listinfo/rats
>>
>> _______________________________________________
>> RATS mailing list
>> RATS@ietf.org
>> https://www.ietf.org/mailman/listinfo/rats
> 
> IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
> 