[Suit] SUIT Firmware Encryption with Dependency

[Ken Takayama <[e-mail]>]

A new idea to leverage SUIT Dependency for Firmware Encryption has come up
to my mind.
Please review and make comments, especially for SUIT Manifest usage and
security considerations.

# Background
## Condition
- The Author creates firmware and its manifest
- The Distribution System encrypts the firmware and distribute it to Devices
- The Device fetches and decrypts encrypted firmware, then check and
install it

## Current I-D
- It introduces new section suit-security-wrapper holding
SUIT_Encryption_Info, which is appended by the Distribution System
- The Device decrypts the encrypted firmware with SUIT_Encryption_Info and
then check it with condition-image-match

## Issues
- Distribution System cannot modify the URI in the manifest where the
encrypted firmware is stored
- SUIT_Encryption_Info is used without verification because it locates out
of the Author's signature

# New idea
## Proposal
- The Author and the Distribution System create manifest respectively
  - Distribution System's manifest fetches encrypted firmware and decrypts
it, and depends on Author's manifest
  - Author's manifest check the decrypted firmware with
condition-image-match
- The Device MUST trust both Author and Distribution System keys to verify
manifests

## Solves
- The Distribution System can freely set the URI to distribute encrypted
firmware in Distribution System's manifest
- SUIT_Encryption_Info is inside signature created by the Distribution
System

## Author's manifest (dependee)
(Only important parts are shown in this example)
```

/ SUIT_Envelope = / {

  suit-authentication-wrapper: SUIT_Authentication / by Author /,

  / inside the signature /

  suit-manifest : << {

    suit-common: << {

      suit-components: [

        [h'00'] / decrypted firmware /

      ]

    } >>,

    suit-install: << [

      / verify that the decrypted firmware is intact /

      suit-directive-set-component-index 0 / [h'00'] /,

      suit-directive-override-parameters {

        suit-parameter-image-digest: <<the digest of raw firmware image
[h'00']>>,

        suit-parameter-image-size: <<the size of raw firmware image
[h'00']>>

      },

      suit-condition-image-match

    ] >>

  } >>

}
```

## Distribution System's manifest (dependent)
(Only important parts are shown in this example)
```

/ SUIT_Envelope = / {

  suit-authentication-wrapper: SUIT_Authentication / by Distribution System
/,

  / inside the signature /

  suit-manifest : << {

    suit-common: << {

      suit-components: [

        [h'00'] / to be decrypted firmware /,

        [h'01'] / encrypted firmware /

      ]

    } >>,

    suit-dependency-resolution: << [

      suit-directive-set-dependency-index 0,

      suit-directive-override-parameters {

        suit-parameter-uri: "https://ds.example.com/manifest_a.suit"

      },

      suit-directive-fetch

    ] >>,

    suit-install: << [

      / loads encrypted firmware /

      suit-directive-set-component-index 1 / [h'01'] /,

      suit-directive-override-parameters {

        suit-parameter-uri: "https://ds.example.com/encrypted-firmware.bin"

      },

      suit-directive-fetch,

      / decrypts it /

      suit-directive-set-component-index 0 / [h'00'] /,

      suit-directive-override-parameters {

        suit-parameter-source-component: 1 / [h'01'] /

        suit-parameter-encryption-info: SUIT_Encryption_Info / how to
decrypt /

      },

      suit-directive-copy,

      / request to parse Author's manifest /

      suit-directive-set-dependency-index 0 / Author's Manifest /,

      suit-process-dependency / triggers suit-install section in Author's
manifest /

    ] >>

  } >>

}

```

Best,
Ken