Re: [Suit] draft-ietf-suit-architecture-01

Hannes,

In the security considerations section, it would be worthwhile to 
indicate that the threats are addressed in details
in section 3.2 (Threat Descriptions) from [I-D.ietf-suit-information-model].

Denis

> Hi Denis,
>
> I think the risk of installing an old firmware version is covered in 
> the information model document, which goes into the details of what a 
> manifest has to contain. See Section 3.2.1 of 
> https://tools.ietf.org/html/draft-ietf-suit-information-model-01
>
> There are essentially three types of documents the working group is 
> aiming to produce: an architecture document, the information model for 
> the manifest and one or multiple serialization formats. You have been 
> looking at the architecture but the appropriate document to read is 
> the information model spec.
>
> Ciao
>
> Hannes
>
> *From:*Suit [mailto:suit-bounces@ietf.org] *On Behalf Of *Denis
> *Sent:* 03 July 2018 11:59
> *To:* suit@ietf.org
> *Subject:* Re: [Suit] draft-ietf-suit-architecture-01
>
> Hannes,
>
> It is well known that software updates are often done to address a 
> security issue. The same applies
> to firmware updates. The current draft is lacking to address 
> protections against the downloading of
> an old firmware version. The threat should be mentioned in the 
> security considerations section.
>
> The main body of the document should mention mechanisms to prevent the 
> replay of an old version
> of the firmware.
>
> Denis
>
>     Hi all,
>
>     I have just submitted version -01 of the architecture document. I
>     have incorporate feedback from the working group, such as
>
>     ·New terminology,
>
>     ·Updates on the operating modes
>
>     ·New architecture figures,
>
>     ·New use cases (by David Brown)
>
>     Here is the new version:
>
>     https://tools.ietf.org/html/draft-ietf-suit-architecture-01
>
>     Here is the diff:
>
>     https://tools.ietf.org/rfcdiff?url2=draft-ietf-suit-architecture-01.txt
>
>     Feedback is appreciated.
>
>     Ciao
>
>     Hannes
>
>     IMPORTANT NOTICE: The contents of this email and any attachments
>     are confidential and may also be privileged. If you are not the
>     intended recipient, please notify the sender immediately and do
>     not disclose the contents to any other person, use it for any
>     purpose, or store or copy the information in any medium. Thank you.
>
>
>     _______________________________________________
>
>     Suit mailing list
>
>     Suit@ietf.org <mailto:Suit@ietf.org>
>
>     https://www.ietf.org/mailman/listinfo/suit
>
> IMPORTANT NOTICE: The contents of this email and any attachments are 
> confidential and may also be privileged. If you are not the intended 
> recipient, please notify the sender immediately and do not disclose 
> the contents to any other person, use it for any purpose, or store or 
> copy the information in any medium. Thank you. 