Re: [Suit] suit-firmware-encryption-00

I agree, Russ. 

Parties subject to the 5/12 Executive Order
(https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/ex
ecutive-order-on-improving-the-nations-cybersecurity/) will likely want to
perform a proactive SCRM risk assessment prior to installation, if my
interpretation of the EO is accurate.

Thanks,

Dick Brooks

Never trust software, always verify and report! T
http://www.reliableenergyanalytics.com
Email: dick@reliableenergyanalytics.com
Tel: +1 978-696-1788

-----Original Message-----
From: Russ Housley <housley@vigilsec.com> 
Sent: Monday, May 31, 2021 12:56 PM
To: Dick Brooks <dick@reliableenergyanalytics.com>
Cc: Michael Richardson <mcr+ietf@sandelman.ca>; Hannes Tschofenig
<Hannes.Tschofenig@arm.com>; suit@ietf.org
Subject: Re: [Suit] suit-firmware-encryption-00

Dick:

Yes, and there are other use cases that require encryption.

Russ

> On May 31, 2021, at 12:53 PM, Dick Brooks
<dick@reliableenergyanalytics.com> wrote:
> 
> " If a trustworthy party in the middle of the distribution path is 
> able to detect a problem with cleartext (but signed) firmware, they 
> can report a vulnerability and refuse to pass the update along."
> 
> This is precisely the function SCRM vendors are performing today. 
> Encrypting a binary object would be an impediment to software supply 
> chain risk assessment functions in place today.
> 
> Thanks,
> 
> Dick Brooks
> 
> Never trust software, always verify and report! T 
> http://www.reliableenergyanalytics.com
> Email: dick@reliableenergyanalytics.com
> Tel: +1 978-696-1788
> 
> -----Original Message-----
> From: Suit <suit-bounces@ietf.org> On Behalf Of Russ Housley
> Sent: Monday, May 31, 2021 12:49 PM
> To: Michael Richardson <mcr+ietf@sandelman.ca>
> Cc: Hannes Tschofenig <Hannes.Tschofenig@arm.com>; suit@ietf.org
> Subject: Re: [Suit] suit-firmware-encryption-00
> 
> Michael:
> 
>>>> I agree that there are also challenges with certification schemes 
>>>> that prevent developers from seeing the source code (or from 
>>>> publishing the source code). That's yet another issue.
>> 
>>> SUIT is using signature for the authentication and integrity of the 
>>> firmware.  If the signature remains in place, a party in the middle 
>>> of the distribution cannot insert any malware.
>> 
>> The encryption of the firmware keeps third parties from auditing the 
>> software updates to determine if malware has been inserted at the
> "factory"
>> Both white and black hats are currently using binary diff systems to 
>> look at patches.  Black hats use this to develop exploits in the gap 
>> between 9am EST and 9am PST!
>> I am suggesting that this is a "Security Consideration"
> 
> Yes, this is a reasonable thing to add to the Security Considerations.
> 
> If a trustworthy party in the middle of the distribution path is able 
> to detect a problem with cleartext (but signed) firmware, they can 
> report a vulnerability and refuse to pass the update along.
> 
> Russ
> _______________________________________________
> Suit mailing list
> Suit@ietf.org
> https://www.ietf.org/mailman/listinfo/suit
> 