Re: [Suit] SUIT Manifest MTI Algorithms

Hi there,

One pain point is how small, microcontroller-based IoT devices may (or may
not) be able to meet this requirement.

We have recently conducted an experimental study on this topic, evaluating
SUIT on common microcontrollers (Cortex-M, ESP-32 and RISC-V)
In particular, we evaluate the cost of upgrading from ed25519 to HSS/LMS
with SUIT used to secure actual RIOT firmware updates:
see preprint at https://eprint.iacr.org/2021/781.pdf

In a nutshell: for small-sized software updates using SUIT with LMS, we
measured impact on network transfer costs (~45% more data over the wire)
and on memory footprint on-device (~35% more Flash memory required), but
only little impact on RAM or execution time, compared to using SUIT with
ed25519. If the baseline is something else  (i.e. not SUIT, or not
ed25519), the overhead might be more.

Note: we studied software-only, generic implementations. E.g., for LMS we
used Scott's implementation https://github.com/cisco/hash-sigs. If the
implementation is in HW or if the crypto is not part of the software that
needs to be updated, this overhead could be less.

What will be considered bearable overhead to upgrade to SUIT-compliant
security, on microcontroller-based IoT devices? That is a question.

Best,

--Emmanuel

On Wed, Nov 10, 2021 at 3:13 PM Russ Housley <housley@vigilsec.com> wrote:

> On Monday, there was a discussion of the mandatory-to-implement (MTI)
> algorithms, which concluded that HSS/LMS MUST be supported and ECDSA SHOULD
> be supported.
>
> If you have concerns with this way forward, please respond to this message
> with your concerns by 26 November 2021.
>
> For the SUIT WG Chairs,
>  Russ
>
> _______________________________________________
> Suit mailing list
> Suit@ietf.org
> https://www.ietf.org/mailman/listinfo/suit
>