Re: [Suit] HR Review: Firmware Update Architecture for IoT Devices

[Dave Thaler <[e-mail]>]

Thanks Gurshabad.

A clarifying question below...

> # Privacy ([RFC8280], section 6.2.2)
> Privacy considerations are with regards to maintaining the confidentiality of firmware image and 
> manifest. Both the firmware image and manifest contain information about the device. As mentioned
> in the older version of the drafts, Class ID and Vendor ID are typically compiled as strings into the
> firmware image. If an untrusted intermediary storage is assumed, as in [SUIT-ARCH], this device
> information will be available to all intermediary and snooping parties, which may violate the device
> operator’s privacy. Additionally, device information can be used by an attacker to design and mount
> targeted attacks on the device.
>
> Concern: The drafts are inconsistent in its recommendation of encryption of firmware images.
> Section 3.3.13 of [SUIT-IM] says that the information model must enable encrypted payloads to
> prevent the attackers from reading the content of the firmware images whereas Section 3.3 of
> [SUIT-ARCH] leaves the choice of encryption to the authors/OEMs.
>
> Recommendation: We recommend removing these inconsistencies, and that the drafts mandate
> the encryption of the firmware image. Accordingly, we recommend the relevant text of section
> 3.3 of [SUIT-ARCH] be updated.

I believe the argument for it not being mandatory is that many IoT devices are not associated with
humans.  For example, factory devices are owned by the factory not a human.   Can you elaborate
on what the concern is for such devices that would warrant mandatory encryption?   Your comment
seems focused on devices associated with humans, and so I cannot tell whether your comment
applies more generally to all use cases that are in scope for the drafts.

Dave