Re: [Suit] HR Review: Firmware Update Architecture for IoT Devices

[Gurshabad Grover <[e-mail]>]

Russ,

Thank you for suggesting a starting point.

Most of the advantages of encrypting the firmware image are already
highlighted in Section 3.3.13 of draft-ietf-suit-information-model-01.
If the advantages (those + the privacy concern) aren't enough to warrant
a recommendation of firmware encryption in the general case, I am in
favour of adding the sentence you proposed.

Also wanted to flag off that the phrase "must enable" in the section is
potentially confusing: maybe we can replace it with a clear indication
of the requirement level.

Thank you.
Gurshabad

On Thursday 12 July 2018 07:34 PM, Russ Housley wrote:
> Gurshabad:
>
> It is clear that we have not come to consensus yet, but I thing some qualifications on the RECOMMENDED or SHOULD statement will be necessary to get there.
>
> Perhaps this is a starting point:  
>
> 	When a device is expected to be deployed in a manner that it is directly
> 	associated with a human, the firmware SHOULD be encrypted to help
> 	preserve the privacy of that human.
>
> Russ