Re: [Suit] HR Review: Firmware Update Architecture for IoT Devices

[Gurshabad Grover <[e-mail]>]

Hi,

Thank you both for your responses and the examples. In light of those,
my thoughts on the encryption recommendation are given below. Also some
comments in-line.

Overall, I think the requirement level of encryption of firmware image
is not sufficiently clear in the drafts. The ambiguity makes it seem
like it is truly OPTIONAL, i.e. it expresses no preference for
encryption. In my opinion, there is a privacy and security advantage in
encrypting the firmware image. Accordingly, the drafts should use the
word "SHOULD" or "RECOMMENDED" for it, which would imply that "there may
exist valid reasons in particular circumstances to ignore [it], but the
full implications must be understood and carefully weighed before
choosing a different course." [RFC2119]

An alternative may be to demarcate the requirement level based on
whether the target device supports decryption. But, my suspicion is that
this may lead to tricky grounds elsewhere.

On Thursday 12 July 2018 03:37 AM, Dave Thaler wrote:
> I believe the argument for it not being mandatory is that many IoT devices are not associated with
> humans.  For example, factory devices are owned by the factory not a human.   Can you elaborate
> on what the concern is for such devices that would warrant mandatory encryption?   Your comment
> seems focused on devices associated with humans, and so I cannot tell whether your comment
> applies more generally to all use cases that are in scope for the drafts.
Thanks, Dave. I completely agree with you in that the privacy concern is
more pertinent for devices directly associated with humans (which I
understand are also in the scope of the drafts). The concern is less
pressing for devices in (say) a factory, where only the security concern
may be applicable, i.e. unintentional exposure of device information
(including version) to observers and eavesdroppersmay increase the
facility's susceptibility to attacks.

On Thursday 12 July 2018 05:20 AM, David Brown wrote:
> In addition, the range of devices covered by these drafts include
> those with insufficient capabilities to support encryption.
Thanks, David. I agree.Hope the clarification suffices. I'm thinking
about the other questions you posed, and will try to get back soon.

Gurshabad