Re: [Suit] How are firmware and firmware versions expressed in manifest?

[Hannes Tschofenig <[e-mail]>]

Hi Michael,

Of course it depends a bit on the type of devices you look at. Many IoT devices are purpose built and they cannot be extended or the extension possibilities are extremely limited. It is not like a PC where you plug in PCI cards, add more DRAM chips, or swap out the processor. This is why an IoT product developed for precision farming will not become your smart vacuum cleaner the next day. RFC 7228 was written to explain that there are many IoT devices that are different to general purpose computing devices. We are mixing the properties of general purpose computing devices with the billions of low end IoT devices out there. Not only is the hardware different but also the software running on those devices. FWIW the software development process is also different.

I have to look at the links Eliot shared but I hope that people are not overly excited about the value of having information about what software version is on their devices for the purpose of drawing security conclusions. You have been at many hackathons where we created firmware for Cortex M-class devices and we used, for example, Mbed TLS in many instances. Does this tell you anything about the security? Can you draw conclusions when you hear that version X has a security vulnerability? Should you be concerned when a security researcher was able to mount a fault injection attack against a specific MCU with a specific version of Mbed TLS running on it? No, not really because you have to know what compile-time configurations were used to build the firmware, what hardware it is running on and what run-time configuration is present.

I understand that people want to have some easy way to find out whether their devices are secure but the story is obviously more complex. Not a surprise to you, for sure, but maybe for others who are not following the embedded development space.

Ciao
Hannes

PS: We are drifting a bit away from the actual manifest work done in this group ...

-----Original Message-----
From: Suit <[e-mail]> On Behalf Of Michael Richardson
Sent: Sunday, June 7, 2020 12:59 AM
To: [e-mail]
Subject: Re: [Suit] How are firmware and firmware versions expressed in manifest?


Hannes Tschofenig <[e-mail]> wrote:
    > I think the BOM terminology is misleading because hardware is not
    > software. The bill of material to produce an IoT product typically does
    > not change (unless you desolder parts) while the software and
    > configuration will regularly change.

This thinking is really a serious part of the problem that I think SBOM is trying to address.

We think that the hardware does not change, because it's hardware, but it does change, because it's a device with an MCU with code baked in by the manufacturer.
*AND* hardware *DOES* change because there are line cards, expansion slots, USB connectors that provide PCIe connectivity...

But, a TPM is good example of something one might call hardware, but it's got a whole SoC in there with software.  That software could have bugs.

    > Leaving that aside, I believe someone active in COSWID needs to clarify
    > what COSWID does. My understanding was that it documents the software

Agreed.

--
Michael Richardson <[e-mail]>, Sandelman Software Works  -= IPv6 IoT consulting =-
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.