Re: [Suit] Reference implementation of SUIT manifest parsing

[Carsten Bormann <[e-mail]>]

Hi David,

Licenses are a difficult area, and I don’t want to go into details on some of the points that you are making.

But we agree in one observation: It would be good to have a liberally licensed reference implementation of SUIT around.
(This statement explicitly does not detract from the merits of having other implementations, as well.)

What are the components we need for that?

https://github.com/cose-wg/COSE-C is BSD-3-clause licensed, and is based on
https://github.com/cabo/cn-cbor which is MIT licensed.

These make some specific implementation choices that may be right or wrong for your environments.
An alternative CBOR library would be https://github.com/intel/tinycbor which also is MIT licensed; I haven’t checked COSE-C on how hard it would be to do the pull-parser approach there as well.  (I don’t see a big problem with sticking to a tree-based implementation on the generation side.)

We’d need liberally licensed implementations of at least SHA-256 and the ECC algorithms of your choice.
A reference implementation of hash-based signatures would be useful, too (allowing us to relax the reliance on ECC).

Finally, it would be useful to have an example implementation of the actual authorization algorithms that devices are likely to employ — even if we don’t standardize them, it is useful to shape expectations here.

Grüße, Carsten