[Suit] SUIT manifest draft 3 prototype implementation

David Brown <david.brown@linaro.org> Fri, 18 January 2019 23:26 UTC

Date: Fri, 18 Jan 2019 16:26:08 -0700
From: David Brown <david.brown@linaro.org>
To: "suit@ietf.org" <suit@ietf.org>
Message-ID: <20190118232608.GA20669@davidb.org>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format="flowed"
Content-Disposition: inline
User-Agent: Mutt/1.10.1 (2018-07-13)
Archived-At: <https://mailarchive.ietf.org/arch/msg/suit/yQYFompVrUywUCTwuQKO8-V8n-o>
Subject: [Suit] SUIT manifest draft 3 prototype implementation
Precedence: list

I have been working on implementing draft 3 of the SUIT manifest in
MCUboot, and have gotten to the point where it may be worth sharing
this with others.

   https://github.com/JuulLabs-OSS/mcuboot/pull/391

Some notable features:

  - This preserves the existing small fixed header on the image used
    by MCUboot (but changes the magic number).  There is a field
    (iv_build_num) in this header that is validated to match the
    sequence number in the SUIT manifest.

  - The SUIT manifest is appended to this image.  I reused the old
    MCUboot manifest format (again changing the magic number), to have
    a way to indicate the length of this data.  This could also have
    been done by encoding the data as a CBOR bstr, but this seemed
    easier.

  - The simulator (in the 'sim' directory) is able to generate a
    specific and narrowly defined signed manifest.  Right now this is
    very hard coded, but I wanted to get an idea of sizes.

  - The decoder uses a template approach where the code contains a
    template manifest (or COSE signature) where certain values are
    #7.xx extension values (starting at 32).  The decoder walks the
    two CBOR structures together, making sure they match exactly,
    except for the capture markers, and those pieces of data are
    stored off.

  - The code was written with keeping the decoder robust against even
    malicious CBOR data.  I appreciate anyone finding a way that it
    can be exploited.

  - Compiled for a Cortex M4, the validation code with cbor parser and
    templates is 1228 bytes of code.  This is in comparison with 628
    bytes of code used to decode and validate the old MCUboot TLV
    manifest format.

  - This is not following any processing instructions or dependencies,
    merely trying to be equivalent to what MCUboot's existing code
    does.

David

[Suit] SUIT manifest draft 3 prototype implementa… David Brown