IETF Logo Mail Archive

Re: [Suit] SUIT Architecture document review

Henk Birkholz <henk.birkholz@sit.fraunhofer.de> Wed, 16 October 2019 15:57 UTC

Return-Path: <henk.birkholz@sit.fraunhofer.de>
X-Original-To: suit@ietfa.amsl.com
Delivered-To: suit@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF09E12095B for <suit@ietfa.amsl.com>; Wed, 16 Oct 2019 08:57:56 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.899
X-Spam-Level:
X-Spam-Status: No, score=-6.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t3cxpBB56kTi for <suit@ietfa.amsl.com>; Wed, 16 Oct 2019 08:57:54 -0700 (PDT)
Received: from mailext.sit.fraunhofer.de (mailext.sit.fraunhofer.de [141.12.72.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A279120955 for <suit@ietf.org>; Wed, 16 Oct 2019 08:57:53 -0700 (PDT)
Received: from mail.sit.fraunhofer.de (mail.sit.fraunhofer.de [141.12.84.171]) by mailext.sit.fraunhofer.de (8.15.2/8.15.2/Debian-10) with ESMTPS id x9GFvmtO013495 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA256 bits=128 verify=NOT); Wed, 16 Oct 2019 17:57:49 +0200
Received: from [172.20.2.249] (199.243.96.171) by mail.sit.fraunhofer.de (141.12.84.171) with Microsoft SMTP Server (TLS) id 14.3.468.0; Wed, 16 Oct 2019 17:57:43 +0200
To: Michael Richardson <mcr+ietf@sandelman.ca>
CC: Hannes Tschofenig <Hannes.Tschofenig@arm.com>, Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>, "suit@ietf.org" <suit@ietf.org>
References: <CAHbuEH6h7Ojc1RDLqGDOvKCqcB6UWu4sg-cozsLFnDsZPm+xCg@mail.gmail.com> <VI1PR08MB53604B1D9121DC24D28D4B4AFA920@VI1PR08MB5360.eurprd08.prod.outlook.com> <10986.1571234661@dooku.sandelman.ca> <7be6c218-37c5-f915-e4dd-5777ec3c903e@sit.fraunhofer.de> <19576.1571240904@dooku.sandelman.ca>
From: Henk Birkholz <henk.birkholz@sit.fraunhofer.de>
Message-ID: <5a2c3301-b7d7-790d-de64-973f5bb13ce6@sit.fraunhofer.de>
Date: Wed, 16 Oct 2019 17:57:39 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0
MIME-Version: 1.0
In-Reply-To: <19576.1571240904@dooku.sandelman.ca>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Language: en-US
Content-Transfer-Encoding: 8bit
X-Originating-IP: [199.243.96.171]
Archived-At: <https://mailarchive.ietf.org/arch/msg/suit/PLWl-FEkTLuXcxZM9uUIWtR_9fE>
Subject: Re: [Suit] SUIT Architecture document review
X-BeenThere: suit@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Software Updates for Internet of Things <suit.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/suit>, <mailto:suit-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/suit/>
List-Post: <mailto:suit@ietf.org>
List-Help: <mailto:suit-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/suit>, <mailto:suit-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 16 Oct 2019 15:58:09 -0000

Hi Michael,
hi list,

if you treat a complex composite, such as an OS utilizing a package 
system, as a binary blob, the manifest can be used to update that. That 
is correct :-)

Viele Grüße,

Henk

On 16.10.19 17:48, Michael Richardson wrote:
> 
> Henk Birkholz <henk.birkholz@sit.fraunhofer.de> wrote:
>      > That said, in theory the SUIT manifest could be used to update basically
>      > things of any size - not only constrained nodes. But I agree with your point
>      > that this is just a "title" problem. There are solutions, such as package
>      > systems,  in place that would require a quite more complex and elaborate
>      > attestation infrastructure and that is not the scope SUIT is targeting, I
>      > think.
> 
> An Android IoT device is effectively an RPI running Android code.
> Yes, it has a Linux kernel and file system, and yes, it can load "apps", but
> in practice, one would always want to replace the entire system as a unit.
> 
> A Mozilla IoT device is also an RPI running Raspbian, with nodejs running
> the application code.  It has apt for packaging, etc. and that's useful
> during development, but shipping that would be dumb.  Ship a signed file
> system image.
> 
> Just remember that RPIs are as big and powerful as the laptop you had ten
> years ago.
> 
>      > m2c: wrt to number of secrets and endorsements that would have to be
>      > maintained per device we also want to be as minimalist as we can be while
>      > remaining feasible, I think.
> 
> --
> Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
>   -= IPv6 IoT consulting =-
>

v2.23.0 | Report a Bug | By Email