Re: [Suit] Suit manifest with variable recipients

[Brendan Moran <[e-mail]>]

> On 22 Jul 2021, at 21:36, Michael Richardson <[e-mail]> wrote:
>> 1: The threat described above: An on-path attacker upstream of the
>> status tracker suppresses a device. This is different from existing
>> SUIT DoS threats because of the targeting of single devices from
>> outside a network. To be clear, this is not simply a DoS; it is an
>> Elevation of Privilege (unprivileged actor decides which devices are
>> updated) AND a Repudiation threat (Not possible to know who chose which
>> devices received updates). The status tracker CAN inform the device of
>> the new update, but the device appears not to have been authorised by
>> the owner of the firmware (via the Content Encryption Key)
>
> Let's say that it's not malicious.
> Let's say that upstream provider noticed that you didn't renew support on
> that device, so they removed the access.

Yes, that’s explicitly called out; it's a recognised use case that I detailed previously. The point is that it would be indistinguishable from an attacker modifying—at rest or in transit—the list of recipients. This is the Repudiation threat. This is not acceptable. There needs to be at-rest protection for the recipient list.

> Shouldn't the Status-Tracker still notice that the device hasn't got the
> right firmware?

Yes, but it can’t tell the difference between a modification by an up-stream provider and by an attacker. This is an open Repudiation threat.

I don’t see why it’s controversial to sign the recipient list—especially if that signature is NOT delivered to constrained nodes.

Brendan
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.