Re: [Teep] [Suit] ECDH-ES + A128KW vs. ECDH-ES + HKDF-256

[Russ Housley <[e-mail]>]

I think ECDH-ES + A128KW covers more use cases.  It can be used with on recipient or many recipients.  So, I'd like to see that be the MTI.

Russ


> On Dec 13, 2023, at 3:38 AM, hannes.tschofenig=[e-mail] wrote:
> 
> Hi all,
>  
> In the SUIT firmware encryption draft we have so far used ECDH-ES + A128KW, which is also what we implemented in t_cose to generate the examples.
>  
> In a discussion with Ken today we realized that the SUIT-MTI draft has always used ECDH-ES + HKDF-256 instead.
>  
> Now, the question is: Should we support both, ECDH-ES + A128KW and ECDH-ES + HKDF-256?
>  
> IHMO we definitely need AES-KW for scenarios where we encrypt a firmware with a CEK once and then distribute that encrypted firmware image to many recipients. In this case, we 
> randomly generate a CEK, 
> encrypt the firmware using this CEK, 
> encrypt this CEK with a KEY unique per recipient with a KEK. The KEK is the result of using ECDH-ES with an KDF, as described in Section 6.4 of RFC 9053. 
>  
> For scenarios where we send one firmware image to one recipient we could use ECDH-ES + HKDF-256 and currently we have a little bit of overhead here by using ECDH-ES + A128KW.
>  
> My preference is to leave the SUIT firmware encryption draft as is and to change the SUIT MTI draft to reference ECDH-ES + A128KW instead of ECDH-ES + HKDF-256.
>  
> Thoughts?
>  
> Ciao
> Hannes
>