Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 11.4 \(3445.8.2\))
From: Carsten Bormann <cabo@tzi.org>
In-Reply-To: <20180619214859.GA4341@davidb.org>
Date: Thu, 21 Jun 2018 13:54:27 +0200
Cc: suit <suit@ietf.org>, dev-mcuboot@lists.runtime.co
Content-Transfer-Encoding: quoted-printable
Message-Id: <95E49C9F-0332-4925-A212-EBDC23B28738@tzi.org>
References: <20180619214859.GA4341@davidb.org>
To: David Brown <david.brown@linaro.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/suit/RMGhpRYq7QgdDVHDHNpOBedjJ3A>
Subject: Re: [Suit] Reference implementation of SUIT manifest parsing
Precedence: list

Hi David,

Licenses are a difficult area, and I don=E2=80=99t want to go into =
details on some of the points that you are making.

But we agree in one observation: It would be good to have a liberally =
licensed reference implementation of SUIT around.
(This statement explicitly does not detract from the merits of having =
other implementations, as well.)

What are the components we need for that?

https://github.com/cose-wg/COSE-C is BSD-3-clause licensed, and is based =
on
https://github.com/cabo/cn-cbor which is MIT licensed.

These make some specific implementation choices that may be right or =
wrong for your environments.
An alternative CBOR library would be https://github.com/intel/tinycbor =
which also is MIT licensed; I haven=E2=80=99t checked COSE-C on how hard =
it would be to do the pull-parser approach there as well.  (I don=E2=80=99=
t see a big problem with sticking to a tree-based implementation on the =
generation side.)

We=E2=80=99d need liberally licensed implementations of at least SHA-256 =
and the ECC algorithms of your choice.
A reference implementation of hash-based signatures would be useful, too =
(allowing us to relax the reliance on ECC).

Finally, it would be useful to have an example implementation of the =
actual authorization algorithms that devices are likely to employ =E2=80=94=
 even if we don=E2=80=99t standardize them, it is useful to shape =
expectations here.

Gr=C3=BC=C3=9Fe, Carsten