Re: [Teep] [Suit] Use of AES-CTR in TEEP?

I think using TEEP to manage firmware updates on constrained devices is a
perfectly valid use case.

When I *think* you're arguing is that GCM should be used for any (not
specific to TEEP)
SUIT manifests for NON-constrained devices, and draft-suit-mti should say
so.
Is that what you're saying?

Dave

> -----Original Message-----
> From: Suit <suit-bounces@ietf.org> On Behalf Of Tschofenig, Hannes
> Sent: Wednesday, October 11, 2023 1:40 AM
> To: Dave Thaler <dthaler=40microsoft.com@dmarc.ietf.org>;
> hannes.tschofenig@gmx.net; teep@ietf.org; suit@ietf.org
> Subject: Re: [Suit] [Teep] Use of AES-CTR in TEEP?
> 
> Hi Dave,
> 
> in my view TAMs are not going to manage firmware updates on constrained
> IoT devices, like microcontrollers, and hence they don't need to support
> algorithms that are specifically designed to take issues of those
constrained
> IoT devices into account. Of course, I would be interested to hear whether
> someone is planning to do this.
> 
> I am wondering whether it is better to create a new draft that lists the
> algorithms for use with TEEP (to avoid confusion with the classical SUIT
use
> cases). The algorithms in draft-ietf-suit-mti are fine for the IoT use
case. I am
> not arguing about that.
> 
> I hope it is clear what I try to avoid. I dont' want developers to use
AES-CTR
> (or AES-CBC) for use cases it was not designed for. If you can use an AEAD
> cipher, you should do it. Here is what RFC 9459 says on this topic:
> 
> "
>    This document specifies AES-CTR and AES-CBC for COSE, which are not
>    AEAD ciphers.  The use of the ciphers is limited to special use
>    cases, such as firmware encryption, where integrity and
>    authentication is provided by another mechanism.
> "
> 
> 
> Ciao
> Hannes
> 
> -----Ursprüngliche Nachricht-----
> Von: Suit <suit-bounces@ietf.org> Im Auftrag von Dave Thaler
> Gesendet: Dienstag, 10. Oktober 2023 20:36
> An: hannes.tschofenig@gmx.net; teep@ietf.org; suit@ietf.org
> Betreff: Re: [Suit] [Teep] Use of AES-CTR in TEEP?
> 
> TEEP requires TAMs to support all MTI algorithms and allows Agents to pick
> among MTI algorithms and may be constrained or not, support crypto offload
> or not, etc. hence the allowing of choice.
> 
> If I understand correctly, you're arguing that a TAM must support both CTR
> and GCM, and an Agent can pick either one, and the suit-mti draft should
> specify both profiles, did I get that right?
> 
> Dave
> 
> 
> > -----Original Message-----
> > From: hannes.tschofenig@gmx.net <hannes.tschofenig@gmx.net>
> > Sent: Tuesday, October 10, 2023 11:00 AM
> > To: Dave Thaler <dthaler@microsoft.com>; teep@ietf.org; suit@ietf.org
> > Subject: RE: [Teep] Use of AES-CTR in TEEP?
> >
> > Sorry for the confusion, Dave. I have hit the "send" button a bit too
fast.
> >
> > It should, of course, read "This adds no new requirements to
> > constrained IoT devices."
> >
> > Ciao
> > Hannes
> >
> > -----Original Message-----
> > From: TEEP <teep-bounces@ietf.org> On Behalf Of Dave Thaler
> > Sent: Dienstag, 10. Oktober 2023 19:41
> > To: hannes.tschofenig@gmx.net; teep@ietf.org; suit@ietf.org
> > Subject: Re: [Teep] Use of AES-CTR in TEEP?
> >
> > Hannes wrote, regarding draft-suit-mti::
> > > I would like to have a new profile added that defines
> > > suit-sha256-es256-ecdh- a128gcm for use with TEEP.
> > > This should be the default profile for use in TEEP.
> > >
> > > This adds new requirements to constrained IoT devices. Constrained
> > > IoT devices should use one of the other 5 profiles already defined.
> >
> > Did I read that right, you want new requirements for _constrained_
devices?
> > Your last two sentences seem to contradict each other, so either
> > there's a typo or I'm not understanding.
> >
> > Dave
> >
> > _______________________________________________
> > TEEP mailing list
> > TEEP@ietf.org
> > https://www/.
> >
> i%2F&data=05%7C01%7Channes.tschofenig%40siemens.com%7C345c31b461
> 654c65
> >
> e7bf08dbc9bfd29d%7C38ae3bcd95794fd4addab42e1495d55a%7C1%7C0%7C
> 63832559
> >
> 7948766603%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIj
> oiV2luMzI
> >
> iLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=hB93IuYuq
> pSRS1GW
> > Op9zCxAxzhwR7vhGXuRvKbW%2BCCU%3D&reserved=0
> >
> etf.org%2Fmailman%2Flistinfo%2Fteep&data=05%7C01%7Cdthaler%40micros
> >
> oft.com%7C71df398b41a948f442ec08dbc9baab47%7C72f988bf86f141af91ab
> >
> 2d7cd011db47%7C1%7C0%7C638325575811642807%7CUnknown%7CTWFpb
> >
> GZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6
> >
> Mn0%3D%7C3000%7C%7C%7C&sdata=z%2BA0%2FHZQ7v%2Bi97e4R%2Bz7H
> > qXwLE9q%2Bq93mb%2BNTXLtF%2F4%3D&reserved=0
> 
> _______________________________________________
> Suit mailing list
> Suit@ietf.org
> https://www.ietf.org/mailman/listinfo/suit
> 
> _______________________________________________
> Suit mailing list
> Suit@ietf.org
> https://www.ietf.org/mailman/listinfo/suit