Re: [Suit] suit-firmware-encryption-00

I believe encryption would "get in the way of" a malware scan performed
during a software supply chain risk assessment. 

Thanks,

Dick Brooks

Never trust software, always verify and report! T
http://www.reliableenergyanalytics.com
Email: dick@reliableenergyanalytics.com
Tel: +1 978-696-1788

-----Original Message-----
From: Suit <suit-bounces@ietf.org> On Behalf Of Hannes Tschofenig
Sent: Monday, May 31, 2021 3:47 PM
To: Michael Richardson <mcr+ietf@sandelman.ca>; Russ Housley
<housley@vigilsec.com>; suit@ietf.org
Subject: Re: [Suit] suit-firmware-encryption-00

Hi Michael,

   > > SUIT is using signature for the authentication and integrity of the
   > > firmware.  If the signature remains in place, a party in the middle
of
   > > the distribution cannot insert any malware.

> The encryption of the firmware keeps third parties from auditing the
software updates to determine if malware has been inserted at the "factory"
> Both white and black hats are currently using binary diff systems to look
at patches.  Black hats use this to develop exploits in the gap between 9am
EST and 9am PST!
> I am suggesting that this is a "Security Consideration"

A description of the software is contained in the COSWID and, as Brendan
suggests, in a MUD file that is included with the manifest (see
https://datatracker.ietf.org/doc/html/draft-moran-suit-mud).
Furthermore, I can imagine that those authorized to audit the software can
do so either based on the source code or by giving them access to the
binary.

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are
confidential and may also be privileged. If you are not the intended
recipient, please notify the sender immediately and do not disclose the
contents to any other person, use it for any purpose, or store or copy the
information in any medium. Thank you.
_______________________________________________
Suit mailing list
Suit@ietf.org
https://www.ietf.org/mailman/listinfo/suit