Re: [Suit] SUIT Architecture document review

Henk Birkholz <henk.birkholz@sit.fraunhofer.de> Wed, 16 October 2019 14:41 UTC

Return-Path: <henk.birkholz@sit.fraunhofer.de>
X-Original-To: suit@ietfa.amsl.com
Delivered-To: suit@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 178211200EF for <suit@ietfa.amsl.com>; Wed, 16 Oct 2019 07:41:24 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.899
X-Spam-Level:
X-Spam-Status: No, score=-6.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZM398IatXoOm for <suit@ietfa.amsl.com>; Wed, 16 Oct 2019 07:41:22 -0700 (PDT)
Received: from mailext.sit.fraunhofer.de (mailext.sit.fraunhofer.de [141.12.72.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA2B712004C for <suit@ietf.org>; Wed, 16 Oct 2019 07:41:20 -0700 (PDT)
Received: from mail.sit.fraunhofer.de (mail.sit.fraunhofer.de [141.12.84.171]) by mailext.sit.fraunhofer.de (8.15.2/8.15.2/Debian-10) with ESMTPS id x9GEfEsT009063 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA256 bits=128 verify=NOT); Wed, 16 Oct 2019 16:41:15 +0200
Received: from [172.20.2.249] (199.243.96.171) by mail.sit.fraunhofer.de (141.12.84.171) with Microsoft SMTP Server (TLS) id 14.3.468.0; Wed, 16 Oct 2019 16:41:09 +0200
To: Michael Richardson <mcr+ietf@sandelman.ca>, Hannes Tschofenig <Hannes.Tschofenig@arm.com>
CC: Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>, "suit@ietf.org" <suit@ietf.org>
References: <CAHbuEH6h7Ojc1RDLqGDOvKCqcB6UWu4sg-cozsLFnDsZPm+xCg@mail.gmail.com> <VI1PR08MB53604B1D9121DC24D28D4B4AFA920@VI1PR08MB5360.eurprd08.prod.outlook.com> <10986.1571234661@dooku.sandelman.ca>
From: Henk Birkholz <henk.birkholz@sit.fraunhofer.de>
Message-ID: <7be6c218-37c5-f915-e4dd-5777ec3c903e@sit.fraunhofer.de>
Date: Wed, 16 Oct 2019 16:41:04 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0
MIME-Version: 1.0
In-Reply-To: <10986.1571234661@dooku.sandelman.ca>
Content-Type: text/plain; charset="utf-8"; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
X-Originating-IP: [199.243.96.171]
Archived-At: <https://mailarchive.ietf.org/arch/msg/suit/O4_MwxV-2pmoU1ARlp1tDx0OkNI>
Subject: Re: [Suit] SUIT Architecture document review
X-BeenThere: suit@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Software Updates for Internet of Things <suit.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/suit>, <mailto:suit-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/suit/>
List-Post: <mailto:suit@ietf.org>
List-Help: <mailto:suit-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/suit>, <mailto:suit-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Oct 2019 14:41:24 -0000

Hi Micheal,
hi thread,

at Kathleen's keynote address in TCG, the "not new" notion that SUIT 
refers to (S)oftware was raised, which - to the audience - seemed to be 
in contradiction with the content being produced.

That said, in theory the SUIT manifest could be used to update basically 
things of any size - not only constrained nodes. But I agree with your 
point that this is just a "title" problem. There are solutions, such as 
package systems,  in place that would require a quite more complex and 
elaborate attestation infrastructure and that is not the scope SUIT is 
targeting, I think.

m2c: wrt to number of secrets and endorsements that would have to be 
maintained per device we also want to be as minimalist as we can be 
while remaining feasible, I think.

Viele Grüße,

Henk

On 16.10.19 16:04, Michael Richardson wrote:
> 
> Hannes Tschofenig <Hannes.Tschofenig@arm.com> wrote:
>      > [Hannes] When you say “larger systems” what do you mean? There are
>      > Windows, Linux and mobile devices out there that already have a
>      > perfectly fine software update mechanism and we are not trying to
>      > replace it with this work. For those devices that run regular operating
>      > systems the lightweight design of the software update mechanism is
>      > apparently less of a concern compared to the design of a firmware
>      > update mechanism for low end IoT devices, as you have witnessed in the
>      > discussions on this list. When you say “large system” are you then
>      > referring to a system that runs Windows, Linux or something similar or
>      > do you have some other system in mind?
> 
> I believe that it would be applicable to Things based upon things that look
> the RPI, running Android IoT or OpenWRT.  While there are package systems, a
> random assortment of packages is undesireable, and can not easily be attested
> to.
> 
> This is what I think that Kathleen is talking about.
> 
> 
> --
> Michael Richardson <mcr+IETF@sandelman.ca>ca>, Sandelman Software Works
>   -= IPv6 IoT consulting =-
> 
> 
> 
> 
> _______________________________________________
> Suit mailing list
> Suit@ietf.org
> https://www.ietf.org/mailman/listinfo/suit
>