[Teep] Issue #238: Uninstalling trusted components

[Dave Thaler <[e-mail]>]

Bringing recent github discussion to the mailing list...

Uninstalling trusted components * Issue #238 * ietf-teep/teep-protocol (github.com)<https://github.com/ietf-teep/teep-protocol/issues/238>
tracks issues encountered in implementation, and we had some discussion on this
during the IETF 114 meeting.


The TEEP protocol used to have a field in the Update message (in addition to any SUIT manifests) that identified which components to remove. Recently the TEEP protocol was updated to just list manifests, under an assumption that the manifest would contain deletion instructions.

The TAM (an update server) sends manifests or references to them, to a TEEP Agent (a device on which to install/update/uninstall components with SUIT manifests).
So to do a deletion, the TAM needs a way to indicate that without it being the component author. It could do that by the TAM creating the SUIT manifests themselves, and incrementing the sequence number to do a deletion but that would require generating manifests on the fly rather than having one manifest for all TEEP Agents, some of which might have the component installed and some not.

It could also do it by not using a newer SUIT manifest but having the uninstall directives included in the installation manifest as Ken proposed, in which case the original TEEP mechanism might make sense to put back in.



https://github.com/ietf-teep/teep-protocol/pull/261 proposes adding "unneeded-tc-list"
back into the Update message.



Ken writes:

> Unlinking specific component specified by SUIT_Component_Identifier in
> unneeded-tc-list may not work well because one SUIT Manifest can contain
> multiple components.
>

> If every SUIT Manifest contains only one component, it doesn't matter.

> If not, unneeded-manifest-list => [ + bstr .cbor SUIT_Envelope_Tagged ]
> or unneeded-manifest-list => [ + bstr .cbor SUIT_Digest ] (reference to
> a specific SUIT Manifest) may work well, and it will unlink all of components inside it.



Akira writes:
> I have talked on this topic with Takayama-san and I prefer the
> unneeded-manifest-list => [ + bstr .cbor SUIT_Digest ].



I also wrote:
> Are you assuming that there exists a separate SUIT manifest (not the
> one used to install the component originally) that has the unlink directives in it? And
> that that manifest is signed with the Trusted Component Developer's signing key (not
> the TAM's key) like the original component manifest was? Doesn't that introduce a
> requirement that the TAM be able to get it from the Trusted Component Developer
> when it needs? What would the manifest sequence number be? Are you proposing
> a requirement that whenever a TAM gets an installation manifest from a Trusted
> Component developer that the developer also supply the uninstall manifest at the
> same time, with some really high sequence number? How is that better than asking
> the developer to put them both in the same manifest? How would uninstall work if
> a TAM went away and the Device Administrator needed to do a local uninstall?
>
> All of the above are fine if the uninstall directives are in the installation manifest
> originally. But otherwise I don't see how this can really work in practice.

So I think there's two questions:

  1.  Which manifest are the uninstall directives in: the original installation manifest? Or some separate manifest with a high sequence number?
  2.  Which syntax do we use in the TEEP protocol to reference what to install?

Putting everything in the above together I now think argues for "in the original installation manifest" with the syntax Akira summarized.

I will update the TEEP protocol document accordingly, but wanted to share this with the list in case there are other comments on this topic.

Dave