Re: [Suit] How are firmware and firmware versions expressed in manifest?

Hannes Tschofenig <Hannes.Tschofenig@arm.com> Fri, 05 June 2020 17:31 UTC

Return-Path: <Hannes.Tschofenig@arm.com>
X-Original-To: suit@ietfa.amsl.com
Delivered-To: suit@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C922A3A0A79 for <suit@ietfa.amsl.com>; Fri, 5 Jun 2020 10:31:10 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=UQFhB5c9; dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=UQFhB5c9
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OKCn-Og0BrEr for <suit@ietfa.amsl.com>; Fri, 5 Jun 2020 10:31:07 -0700 (PDT)
Received: from EUR04-HE1-obe.outbound.protection.outlook.com (mail-eopbgr70085.outbound.protection.outlook.com [40.107.7.85]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 321A63A0A78 for <suit@ietf.org>; Fri, 5 Jun 2020 10:31:07 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fpzIqrw+/ANmoFwHMwo1lqy84CcHeuTEM2dmZ6QwIBM=; b=UQFhB5c9/FJUSAYK4VIZSvFJ7y/BrtDSgtPuE6y85PFQtC0aTN26RbnSi73ZO9mx32RICnICnO+mkGU4RETMrrE+t+HKxCpoyX+mHq/k8zxd8sqpwSDPEIS2rNW9uHZ9mTOvXYmtvdHsfDFqZZFschCwiafae92m2E2f3hhaqHY=
Received: from DBBPR09CA0011.eurprd09.prod.outlook.com (2603:10a6:10:c0::23) by VI1PR08MB3824.eurprd08.prod.outlook.com (2603:10a6:803:bf::27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3066.18; Fri, 5 Jun 2020 17:31:03 +0000
Received: from DB5EUR03FT044.eop-EUR03.prod.protection.outlook.com (2603:10a6:10:c0:cafe::3b) by DBBPR09CA0011.outlook.office365.com (2603:10a6:10:c0::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3066.18 via Frontend Transport; Fri, 5 Jun 2020 17:31:03 +0000
X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=bestguesspass action=none header.from=arm.com;
Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com;
Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by DB5EUR03FT044.mail.protection.outlook.com (10.152.21.167) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3066.18 via Frontend Transport; Fri, 5 Jun 2020 17:31:03 +0000
Received: ("Tessian outbound 39cdd740f5cb:v59"); Fri, 05 Jun 2020 17:31:03 +0000
X-CR-MTA-TID: 64aa7808
Received: from bce5be33cd1f.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id E5B934BC-A1C5-4970-B459-DC2CA0BC3511.1; Fri, 05 Jun 2020 17:30:58 +0000
Received: from EUR03-VE1-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id bce5be33cd1f.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Fri, 05 Jun 2020 17:30:58 +0000
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=EyIJOIXAMYvug+OxXfbUP4+A+BLDfXC6V+ux1iBIKvpbEYLeXfHpJiSYd9OQo2cULSUolBxSNJxffAv0+1AmGjYgeMEnbWCsXuDJOkc7rCcbvnKfEJV2GiEoYkCtzW52s/DOJe83rjNV4JXYfllSwTS91Ss0seHKCW1r/IwT8t5DaSfsySP1r3GBmxkf15fmwba9Nlhr4aWUmLsjjgnh7qXZQu4Cbg2C9Mc1WU7mkmxfGfq5swFThyNTfBgXqfnIWEtJz8feUF7WE0ZAqWpbgDs7Igj5ATmTJgQWUURI6hkcLWmLo+fO5PZJ3QTpyQDe3/CxC18PIjT7zbXbik+EFw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fpzIqrw+/ANmoFwHMwo1lqy84CcHeuTEM2dmZ6QwIBM=; b=C/pr7Fc2CT91Z2wxHxfrXSUGDHsdNpeHH3ynXmV0NinGRXCAujHPz1DmlRNGJJK+WIOy9Bi0D6PTDej0C8RSbmg3q5a8OiQjMIipVujHRE25+vGD6CeYZCjyawR6FqVS0exS2h7u3t4n0dsCOEraynRZN9RlOM1huo4RJcIHf536i0LrlumwPZ6cJIv9QwyfiP9RHhVo1l1Udjz00dWVhGWJbRbayTKhELzQISyoW9/5I8Xj5O/Bf5IXXdVUjbjZSVNGkyeAQtlw+Ir4XUK5fCHe6pQ7WPsvCNiPIcvelm1i//7cS/C2ce+Td+xGinsFrBpfhoavQNCZ5vPSS65Hxw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fpzIqrw+/ANmoFwHMwo1lqy84CcHeuTEM2dmZ6QwIBM=; b=UQFhB5c9/FJUSAYK4VIZSvFJ7y/BrtDSgtPuE6y85PFQtC0aTN26RbnSi73ZO9mx32RICnICnO+mkGU4RETMrrE+t+HKxCpoyX+mHq/k8zxd8sqpwSDPEIS2rNW9uHZ9mTOvXYmtvdHsfDFqZZFschCwiafae92m2E2f3hhaqHY=
Received: from AM0PR08MB3716.eurprd08.prod.outlook.com (2603:10a6:208:106::13) by AM0PR08MB3250.eurprd08.prod.outlook.com (2603:10a6:208:5f::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3066.20; Fri, 5 Jun 2020 17:30:56 +0000
Received: from AM0PR08MB3716.eurprd08.prod.outlook.com ([fe80::39f5:e4d9:51ff:eae]) by AM0PR08MB3716.eurprd08.prod.outlook.com ([fe80::39f5:e4d9:51ff:eae%7]) with mapi id 15.20.3066.022; Fri, 5 Jun 2020 17:30:56 +0000
From: Hannes Tschofenig <Hannes.Tschofenig@arm.com>
To: Eliot Lear <lear@cisco.com>, Dick Brooks <dick@reliableenergyanalytics.com>
CC: Michael Richardson <mcr+ietf@sandelman.ca>, "suit@ietf.org" <suit@ietf.org>, Saad EL JAOUHARI <saadeljaou@gmail.com>, Henk Birkholz <henk.birkholz@sit.fraunhofer.de>
Thread-Topic: [Suit] How are firmware and firmware versions expressed in manifest?
Thread-Index: AdY5iIX3N33NtGULTtOAukxF+Y4+yAAR9vKAAC3Wx2AAEkCYgAAahNIAAAZpzwAAAp+aoA==
Date: Fri, 5 Jun 2020 17:30:55 +0000
Message-ID: <AM0PR08MB3716C555048993639B14D76FFA860@AM0PR08MB3716.eurprd08.prod.outlook.com>
References: <AM0PR08MB371631B7C1E6B50DCA29049AFA880@AM0PR08MB3716.eurprd08.prod.outlook.com> <8b6d01d639d0$62614150$2723c3f0$@reliableenergyanalytics.com> <AM0PR08MB37166AD36B5AA36EA7D7CA9BFA890@AM0PR08MB3716.eurprd08.prod.outlook.com> <20437.1591317129@localhost> <1076601d63b3a$d53f5d90$7fbe18b0$@reliableenergyanalytics.com> <BF5D5E46-4A7C-44A7-8554-5DE1E03A3F21@cisco.com>
In-Reply-To: <BF5D5E46-4A7C-44A7-8554-5DE1E03A3F21@cisco.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-ts-tracking-id: 0ac97948-54ad-4ca2-b97e-be7f9c7d1d06.1
x-checkrecipientchecked: true
Authentication-Results-Original: cisco.com; dkim=none (message not signed) header.d=none;cisco.com; dmarc=none action=none header.from=arm.com;
x-originating-ip: [156.67.194.193]
x-ms-publictraffictype: Email
X-MS-Office365-Filtering-HT: Tenant
X-MS-Office365-Filtering-Correlation-Id: d2fe88ae-8506-4b03-ed9b-08d809763889
x-ms-traffictypediagnostic: AM0PR08MB3250:|VI1PR08MB3824:
X-Microsoft-Antispam-PRVS: <VI1PR08MB3824AFF385E92510C78D879BFA860@VI1PR08MB3824.eurprd08.prod.outlook.com>
x-checkrecipientrouted: true
nodisclaimer: true
x-ms-oob-tlc-oobclassifiers: OLM:9508;OLM:10000;
x-forefront-prvs: 0425A67DEF
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam-Untrusted: BCL:0;
X-Microsoft-Antispam-Message-Info-Original: BlB6KdU1oOJPHIs1d4vg3jjMx8DCOnbJe7K49cUKPTeZcAd8ZoWWCsrKvXFf36Y9uz5KmnLpnJZZz803roijtqGib2W4MaeyzbpGtS0hqTnTCr4E8IwyUN7qfCA03aR31DvlMGEuRqb/kCKK3yKh/QQgRde4hDSdFhYToa4YwMeQGCovr2+dfYdpCvOLU1Y3/GXgbYJxTT1cfM1KiAPB1sfmxhDSuncYwogpR0ejrspWUBmt7UYIWSjlFnCKcvlY2bSrxlFhTHOmKXCWgxfYTwa2K/x0evDbYxGAYlKDGRZywG4V05Lqi7BhSF16OQP/v8JEhRhQRildRt+IlJb1dlOgmCTwz92B093CXD9N0L6wiDzP5foN3+tigLVxmTqLXcb8vK1HENQj7BasOgGzpA==
X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR08MB3716.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(396003)(366004)(136003)(39860400002)(346002)(376002)(53546011)(186003)(66946007)(76116006)(966005)(66556008)(8936002)(71200400001)(64756008)(8676002)(66446008)(86362001)(66476007)(7696005)(316002)(52536014)(110136005)(54906003)(6506007)(2906002)(26005)(4326008)(478600001)(33656002)(55016002)(5660300002)(9686003)(83380400001); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata: G+CGinb97pTK7feKv3ISzbIMGNkFtw2d791tLDLUhiYGqdto9rpiY9H0t0bMGA+HIY1J/M5aaebrPiUWqTrGd3cVkYmsKfH4ktGXWkrKOfRMt3Zk7ldMglyYGC0CjuOWfp47xqP2ohp3gh1F2lKoHi8VH90GCCJ3McRyB6km9FSefvvrkJ7ZDijVPRExLR3mQiOWH8TBvJ5fIKYKa9v6Tdc+Lbly6wKgMxp+gb5vNkLeGWxcNiISnAnOQ73P/uLvC35YOC7gJniIhBrEqKaP1bAWNWJ9JIAJPSq7hvkS09sniCjHKDQuFakSk+gC36ta05eZXVKtcByQ7pmgHMbRWQnu4lwm5qCGKl7ADHa9BFIKOAbV1ffitknKiGVye1jCaDW0KYadpRTuPcsCrLCoplr8XtAdJyNdTaJ6EXOGe3PywHcAmT9l4P/XVlpkyRxOqirH/1j6OxG4L7I3jJtfMJOOBreBcMwa+0xVDFYg3Nxb9jPAn4QMTa1XH/oqGtX+
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB3250
Original-Authentication-Results: cisco.com; dkim=none (message not signed) header.d=none;cisco.com; dmarc=none action=none header.from=arm.com;
X-EOPAttributedMessage: 0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: DB5EUR03FT044.eop-EUR03.prod.protection.outlook.com
X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFTY:; SFS:(4636009)(136003)(39860400002)(346002)(396003)(376002)(46966005)(47076004)(2906002)(86362001)(70586007)(8676002)(478600001)(8936002)(54906003)(966005)(33656002)(70206006)(83380400001)(110136005)(316002)(55016002)(53546011)(356005)(7696005)(82740400003)(107886003)(6506007)(4326008)(5660300002)(81166007)(52536014)(336012)(26005)(186003)(9686003)(82310400002); DIR:OUT; SFP:1101;
X-MS-Office365-Filtering-Correlation-Id-Prvs: b391328f-d3ea-41a0-e226-08d809763444
X-Forefront-PRVS: 0425A67DEF
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: J8CTyMrBl2Kxb0vLhflUgzhMqJrruFUc4qHykMIaHF8RLktNZUkSZ4fVXCQnR46dqgcTbbFp/4F6oy/ES/H720DO5QdMVs3pWPIt9fyAKq4H9y/VEIsz2DPuzA4gv62lzk+neDmUGtnWcNwrA/aToIz/f6trwiI3RCtOMwXCNDNEAq6D9YORAAtuiP83RWpT9YeQdIcalBCZ7sFAmFNrgN5S8xOLeXor5lVYZj5WZpbFQGA2agcQI5ONLsdxmBa8+bKNO/eZxonTc5wE0kkDBx930GJpNH0xN6AH5YzKFD0DOPivm85jI1KCudEbu2rcfRos3QajmQaL4n1uSBT/CFNWU6WgF2OmzJp87Bsr0CtSvExLPkO6GW6ekHHQdHnDKEwQV0kCPBKuHoh6lyVr47Vtt58+XkpCGXSRBpnXwS2ELGcJ8jzpbHz6de3BxPfzRr6pQEwuUp6z5KAsBIvKckAyEHjvsEp9LJ5KKwZ1klI=
X-OriginatorOrg: arm.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Jun 2020 17:31:03.2209 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: d2fe88ae-8506-4b03-ed9b-08d809763889
X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR08MB3824
Archived-At: <https://mailarchive.ietf.org/arch/msg/suit/PDG4bgxhRDUmrbt5KZfwcMKtoVo>
Subject: Re: [Suit] How are firmware and firmware versions expressed in manifest?
X-BeenThere: suit@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Software Updates for Internet of Things <suit.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/suit>, <mailto:suit-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/suit/>
List-Post: <mailto:suit@ietf.org>
List-Help: <mailto:suit-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/suit>, <mailto:suit-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 05 Jun 2020 17:31:11 -0000

FWIW I thought that COSWID would provide information about the software libraries on a device.

-----Original Message-----
From: Eliot Lear <lear@cisco.com>
Sent: Friday, June 5, 2020 6:15 PM
To: Dick Brooks <dick@reliableenergyanalytics.com>
Cc: Michael Richardson <mcr+ietf@sandelman.ca>ca>; Hannes Tschofenig <Hannes.Tschofenig@arm.com>om>; suit@ietf.org; Saad EL JAOUHARI <saadeljaou@gmail.com>om>; Henk Birkholz <henk.birkholz@sit.fraunhofer.de>
Subject: Re: [Suit] How are firmware and firmware versions expressed in manifest?

Dick,

Think of MUD as nothing more than a JSON blob that points at things or otherwise provides guidance to the deployment about the device.  It’s quite generic.  One of the things it can point to is how to retrieve a software bill of materials.  Another thing it can point to is a list of certifications.  If JSON scares you, it wouldn’t be that hard to serialize into CBOR.

Eliot



> On 5 Jun 2020, at 15:11, Dick Brooks <dick@reliableenergyanalytics.com> wrote:
>
> Thanks, Michael Richardson. I'm uncertain that MUD has exactly what
> I'm looking for to meet NERC CIP-010-3 R1, Part 1.6 expectations,
> after a cursory look at the standard. I don't see where the MUD
> process would support deep introspection and corroborating evidence
> within a risk assessment control prior to deployment, which is what I
> need for NERC CIP-010-3. The base case I'm working with is where a
> device in the Bulk Electric System (BES) has been acquired and
> deployed, that contains a firmware component. A patch has been
> distributed for that firmware and a grid operator wants to perform a
> risk assessment on the patch before any attempt at deployment.
>
> I'm still thinking that SUIT may be more appropriate than MUD for this
> use case, but I may be missing an important point. Can you provide a
> distinction between MUD and SUIT that would apply to the use case I
> describe, to help me understand your assertion that MUD may be more appropriate than SUIT?
>
> I genuinely just want to find the best solution to the problem I'm
> trying to solve, whatever that turns out to be.
>
> Wonderful thing about standards, there are so many to choose from!


>
> Thanks,
>
> Dick Brooks
>
> Never trust software, always verify and report! T
> http://www.reliableenergyanalytics.com
> Email: dick@reliableenergyanalytics.com
> Tel: +1 978-696-1788
>
> -----Original Message-----
> From: Michael Richardson <mcr+ietf@sandelman.ca>
> Sent: Thursday, June 04, 2020 8:32 PM
> To: Hannes Tschofenig <Hannes.Tschofenig@arm.com>om>; Dick Brooks
> <dick@reliableenergyanalytics.com>om>; suit@ietf.org; 'Saad EL JAOUHARI'
> <saadeljaou@gmail.com>om>; Eliot Lear <lear@cisco.com>om>; Henk Birkholz
> <henk.birkholz@sit.fraunhofer.de>
> Subject: Re: [Suit] How are firmware and firmware versions expressed
> in manifest?
>
>
> Hannes Tschofenig <Hannes.Tschofenig@arm.com> wrote:
>> * Finally, there is also a version condition. This allows to express
>> that a manifest is applicable to one or multiple versions of the
>> firmware. As described in the information model draft, this situation
>> occurs when you upload an application that relies on existing
>> software to be present on the device. (Think of it as an API
>> version.)
>
>> It is important to note that the manifest is not meant to be used to
>> describe the software running on the device. This is the job of other
>> tools, such as COSWID. The manifest instead provides instructions on
>> how to update firmware and to accomplish secure boot.
>
> There are some efforts to include RFC8520 (MUD) definitions into the
> Manifest, either by value or reference. (Henk!)
>
> There are other efforts to include CoSWID into RFC8520, I think.
> I may be mistaken as to the direction of the arrows here.
>
>    DB> I'm hoping to use the manifest as a virtual SBOM. Will let you know
>    DB> if I'm successful in this regard.
>
> The manifest could include a reference to a SBOM, but I don't think it
> is reasonable to to include it by value.  I think that the right place
> to get the SBOM is via an RFC8520 (MUD) object.
>
> I think that it would help if SUIT considered how some BCPs and/or
> Applicability statements that helped to tie some things together.
> (Specifically, from the charter:
>       This group will not define any new transport or discovery mechanisms,
>       but may describe how to use existing mechanisms within the
> architecture.
> )
> A lot of Enterprises would like to cache all firmware contents
> somewhere locally, avoiding external access for devices.  There is an
> overlap here with processes that might report on success updates,
> caching the new SBOMs into an audit system, etc.
>
> --
> Michael Richardson <mcr+IETF@sandelman.ca>ca>, Sandelman Software Works
> -=
> IPv6 IoT consulting =-
>
>
>
>

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.