Re: [Suit] Improvements to draft-moran-suit-manifest-03

[David Brown <[e-mail]>]

On Thu, Feb 28, 2019 at 03:38:28PM +0000, Brendan Moran wrote:

>I think you’re right that there may be threat vectors that arise from shedding
>some data, but not other data. I’m trying to adapt the shedding of data so that
>it works a bit better. Data should only be shed if it’s never needed again. For
>instance, you don’t need the information used to install a payload after that
>payload is installed. So, that information should be shed as a block. Likewise,
>you don’t need text once the manifest is pushed to a device, since this is for
>machine consumption only.

MCUboot has an interesting case/configuration where this isn't quite
true, about the installation.

MCUboot can be configured to perform "swap" upgrades.  Flash is
partitioned into a primary and an upgrade slot (and there is a scratch
area to use to do the swap with recovery).  After the image swap, it
tries running the new image.  If something goes wrong, and the image
is not able to boot up and mark itself as valid, the next reboot,
MCUboot will swap the two images back.

In this case, any information on installation would still need to be
there.  Although, also in this case, the installation is very simple,
and isn't going to be large (my current prototype does not include
it).

David