Re: [Teep] Use of AES-CTR in TEEP?

Hi Dave,

in my view TAMs are not going to manage firmware updates on constrained IoT devices, like microcontrollers, and hence they don't need to support algorithms that are specifically designed to take issues of those constrained IoT devices into account. Of course, I would be interested to hear whether someone is planning to do this.

I am wondering whether it is better to create a new draft that lists the algorithms for use with TEEP (to avoid confusion with the classical SUIT use cases). The algorithms in draft-ietf-suit-mti are fine for the IoT use case. I am not arguing about that.

I hope it is clear what I try to avoid. I dont' want developers to use AES-CTR (or AES-CBC) for use cases it was not designed for. If you can use an AEAD cipher, you should do it. Here is what RFC 9459 says on this topic:

"
   This document specifies AES-CTR and AES-CBC for COSE, which are not
   AEAD ciphers.  The use of the ciphers is limited to special use
   cases, such as firmware encryption, where integrity and
   authentication is provided by another mechanism.
"

Ciao
Hannes

-----Ursprüngliche Nachricht-----
Von: Suit <suit-bounces@ietf.org> Im Auftrag von Dave Thaler
Gesendet: Dienstag, 10. Oktober 2023 20:36
An: hannes.tschofenig@gmx.net; teep@ietf.org; suit@ietf.org
Betreff: Re: [Suit] [Teep] Use of AES-CTR in TEEP?

TEEP requires TAMs to support all MTI algorithms and allows Agents to pick among MTI algorithms and may be constrained or not, support crypto offload or not, etc. hence the allowing of choice.

If I understand correctly, you're arguing that a TAM must support both CTR and GCM, and an Agent can pick either one, and the suit-mti draft should specify both profiles, did I get that right?

Dave

> -----Original Message-----
> From: hannes.tschofenig@gmx.net <hannes.tschofenig@gmx.net>
> Sent: Tuesday, October 10, 2023 11:00 AM
> To: Dave Thaler <dthaler@microsoft.com>; teep@ietf.org; suit@ietf.org
> Subject: RE: [Teep] Use of AES-CTR in TEEP?
>
> Sorry for the confusion, Dave. I have hit the "send" button a bit too fast.
>
> It should, of course, read "This adds no new requirements to
> constrained IoT devices."
>
> Ciao
> Hannes
>
> -----Original Message-----
> From: TEEP <teep-bounces@ietf.org> On Behalf Of Dave Thaler
> Sent: Dienstag, 10. Oktober 2023 19:41
> To: hannes.tschofenig@gmx.net; teep@ietf.org; suit@ietf.org
> Subject: Re: [Teep] Use of AES-CTR in TEEP?
>
> Hannes wrote, regarding draft-suit-mti::
> > I would like to have a new profile added that defines
> > suit-sha256-es256-ecdh- a128gcm for use with TEEP.
> > This should be the default profile for use in TEEP.
> >
> > This adds new requirements to constrained IoT devices. Constrained
> > IoT devices should use one of the other 5 profiles already defined.
>
> Did I read that right, you want new requirements for _constrained_ devices?
> Your last two sentences seem to contradict each other, so either
> there's a typo or I'm not understanding.
>
> Dave
>
> _______________________________________________
> TEEP mailing list
> TEEP@ietf.org
> https://www/.
> i%2F&data=05%7C01%7Channes.tschofenig%40siemens.com%7C345c31b461654c65
> e7bf08dbc9bfd29d%7C38ae3bcd95794fd4addab42e1495d55a%7C1%7C0%7C63832559
> 7948766603%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzI
> iLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=hB93IuYuqpSRS1GW
> Op9zCxAxzhwR7vhGXuRvKbW%2BCCU%3D&reserved=0
> etf.org%2Fmailman%2Flistinfo%2Fteep&data=05%7C01%7Cdthaler%40micros
> oft.com%7C71df398b41a948f442ec08dbc9baab47%7C72f988bf86f141af91ab
> 2d7cd011db47%7C1%7C0%7C638325575811642807%7CUnknown%7CTWFpb
> GZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6
> Mn0%3D%7C3000%7C%7C%7C&sdata=z%2BA0%2FHZQ7v%2Bi97e4R%2Bz7H
> qXwLE9q%2Bq93mb%2BNTXLtF%2F4%3D&reserved=0

_______________________________________________
Suit mailing list
Suit@ietf.org
https://www.ietf.org/mailman/listinfo/suit