Re: [Suit] suit-firmware-encryption-00

Dick:

Yes, and there are other use cases that require encryption.

Russ

> On May 31, 2021, at 12:53 PM, Dick Brooks <dick@reliableenergyanalytics.com> wrote:
> 
> " If a trustworthy party in the middle of the distribution path is able to
> detect a problem with cleartext (but signed) firmware, they can report a
> vulnerability and refuse to pass the update along."
> 
> This is precisely the function SCRM vendors are performing today. Encrypting
> a binary object would be an impediment to software supply chain risk
> assessment functions in place today.
> 
> Thanks,
> 
> Dick Brooks
> 
> Never trust software, always verify and report! T
> http://www.reliableenergyanalytics.com
> Email: dick@reliableenergyanalytics.com
> Tel: +1 978-696-1788
> 
> -----Original Message-----
> From: Suit <suit-bounces@ietf.org> On Behalf Of Russ Housley
> Sent: Monday, May 31, 2021 12:49 PM
> To: Michael Richardson <mcr+ietf@sandelman.ca>
> Cc: Hannes Tschofenig <Hannes.Tschofenig@arm.com>; suit@ietf.org
> Subject: Re: [Suit] suit-firmware-encryption-00
> 
> Michael:
> 
>>>> I agree that there are also challenges with certification schemes 
>>>> that prevent developers from seeing the source code (or from 
>>>> publishing the source code). That's yet another issue.
>> 
>>> SUIT is using signature for the authentication and integrity of the 
>>> firmware.  If the signature remains in place, a party in the middle 
>>> of the distribution cannot insert any malware.
>> 
>> The encryption of the firmware keeps third parties from auditing the 
>> software updates to determine if malware has been inserted at the
> "factory"
>> Both white and black hats are currently using binary diff systems to 
>> look at patches.  Black hats use this to develop exploits in the gap 
>> between 9am EST and 9am PST!
>> I am suggesting that this is a "Security Consideration"
> 
> Yes, this is a reasonable thing to add to the Security Considerations.
> 
> If a trustworthy party in the middle of the distribution path is able to
> detect a problem with cleartext (but signed) firmware, they can report a
> vulnerability and refuse to pass the update along.
> 
> Russ
> _______________________________________________
> Suit mailing list
> Suit@ietf.org
> https://www.ietf.org/mailman/listinfo/suit
> 