Encrypted Payloads in SUIT Manifests
draft-ietf-suit-firmware-encryption-12
The information below is for an old version of the document.
| Document | Type |
This is an older version of an Internet-Draft whose latest revision state is "Active".
|
|
|---|---|---|---|
| Authors | Hannes Tschofenig , Russ Housley , Brendan Moran , David Brown , Ken Takayama | ||
| Last updated | 2023-04-13 (Latest revision 2023-03-13) | ||
| Replaces | draft-tschofenig-suit-firmware-encryption | ||
| RFC stream | Internet Engineering Task Force (IETF) | ||
| Formats | |||
| Additional resources | Mailing list discussion | ||
| Stream | WG state | WG Document | |
| Associated WG milestone |
|
||
| Document shepherd | (None) | ||
| IESG | IESG state | I-D Exists | |
| Consensus boilerplate | Unknown | ||
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
draft-ietf-suit-firmware-encryption-12
SUIT H. Tschofenig
Internet-Draft
Intended status: Standards Track R. Housley
Expires: 15 October 2023 Vigil Security
B. Moran
Arm Limited
D. Brown
Linaro
K. Takayama
SECOM CO., LTD.
13 April 2023
Encrypted Payloads in SUIT Manifests
draft-ietf-suit-firmware-encryption-12
Abstract
This document specifies techniques for encrypting software, firmware
and personalization data by utilizing the IETF SUIT manifest. Key
agreement is provided by ephemeral-static (ES) Diffie-Hellman (DH)
and AES Key Wrap (AES-KW). ES-DH uses public key cryptography while
AES-KW uses a pre-shared key-encryption key. Encryption of the
plaintext is accomplished with conventional symmetric key
cryptography.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 15 October 2023.
Copyright Notice
Copyright (c) 2023 IETF Trust and the persons identified as the
document authors. All rights reserved.
Tschofenig, et al. Expires 15 October 2023 [Page 1]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Revised BSD License text as
described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Revised BSD License.
This document may contain material from IETF Documents or IETF
Contributions published or made publicly available before November
10, 2008. The person(s) controlling the copyright in some of this
material may not have granted the IETF Trust the right to allow
modifications of such material outside the IETF Standards Process.
Without obtaining an adequate license from the person(s) controlling
the copyright in such materials, this document may not be modified
outside the IETF Standards Process, and derivative works of it may
not be created outside the IETF Standards Process, except to format
it for publication as an RFC or to translate it into languages other
than English.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Conventions and Terminology . . . . . . . . . . . . . . . . . 4
3. Architecture . . . . . . . . . . . . . . . . . . . . . . . . 4
4. New Extensions . . . . . . . . . . . . . . . . . . . . . . . 6
5. Extended Directives . . . . . . . . . . . . . . . . . . . . . 7
6. Content Key Distribution Methods . . . . . . . . . . . . . . 7
6.1. Content Key Distribution with AES Key Wrap . . . . . . . 8
6.1.1. Introduction . . . . . . . . . . . . . . . . . . . . 8
6.1.2. Deployment Options . . . . . . . . . . . . . . . . . 8
6.1.3. CDDL . . . . . . . . . . . . . . . . . . . . . . . . 9
6.1.4. Example . . . . . . . . . . . . . . . . . . . . . . . 11
6.2. Content Key Distribution with Ephemeral-Static
Diffie-Hellman . . . . . . . . . . . . . . . . . . . . . 12
6.2.1. Introduction . . . . . . . . . . . . . . . . . . . . 12
6.2.2. Deployment Options . . . . . . . . . . . . . . . . . 13
6.2.3. CDDL . . . . . . . . . . . . . . . . . . . . . . . . 14
6.2.4. Example . . . . . . . . . . . . . . . . . . . . . . . 15
7. CEK Verification . . . . . . . . . . . . . . . . . . . . . . 17
8. Firmware Updates on IoT Devices with Flash Memory. . . . . . 17
8.1. AES-CBC . . . . . . . . . . . . . . . . . . . . . . . . . 20
8.2. AES-CTR . . . . . . . . . . . . . . . . . . . . . . . . . 21
9. Complete Examples . . . . . . . . . . . . . . . . . . . . . . 22
9.1. AES Key Wrap Example with Write Directive . . . . . . . . 23
9.2. AES Key Wrap Example with Fetch + Copy Directives . . . . 25
10. Security Considerations . . . . . . . . . . . . . . . . . . . 27
Tschofenig, et al. Expires 15 October 2023 [Page 2]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
11. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 28
12. References . . . . . . . . . . . . . . . . . . . . . . . . . 28
12.1. Normative References . . . . . . . . . . . . . . . . . . 28
12.2. Informative References . . . . . . . . . . . . . . . . . 29
Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 30
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 30
1. Introduction
Vulnerabilities with Internet of Things (IoT) devices have raised the
need for a reliable and secure firmware update mechanism that is also
suitable for constrained devices. To protect firmware images the
SUIT manifest format was developed [I-D.ietf-suit-manifest]. The
SUIT manifest provides a bundle of metadata about the firmware for an
IoT device, where to find the firmware image, and the devices to
which it applies.
The SUIT information model [RFC9124] details the information that has
to be offered by the SUIT manifest format. In addition to offering
protection against modification, which is provided by a digital
signature or a message authentication code, the firmware image may
also be afforded confidentiality using encryption.
Encryption prevents third parties, including attackers, from gaining
access to the firmware binary. Hackers typically need intimate
knowledge of the target firmware to mount their attacks. For
example, return-oriented programming (ROP) [ROP] requires access to
the binary and encryption makes it much more difficult to write
exploits.
The SUIT manifest provides the data needed for authorized recipients
of the firmware image to decrypt it. The firmware image is encrypted
using a symmetric key.
A symmetric key can be established using a variety of mechanisms;
this document defines two approaches for use with the IETF SUIT
manifest, namely:
* Ephemeral-Static (ES) Diffie-Hellman (DH), and
* AES Key Wrap (AES-KW) using a pre-shared key-encryption key (KEK).
OPEN ISSUE: Should KEM algorithms also be supported?
These choices reduce the number of possible key establishment options
and thereby help increase interoperability between different SUIT
manifest parser implementations.
Tschofenig, et al. Expires 15 October 2023 [Page 3]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
While the original motivating use case of this document was firmware
encryption, SUIT manifests may require payloads other than firmware
images to experience confidentiality protection, such as
* software packages,
* personalization data,
* configuration data, and
* machine learning models.
Hence, the term payload is used to generically refer to those objects
that may be subject to encryption.
2. Conventions and Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in
BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here.
This document assumes familiarity with the IETF SUIT manifest
[I-D.ietf-suit-manifest], the SUIT information model [RFC9124] and
the SUIT architecture [RFC9019].
The terms sender and recipient have the following meaning:
* Sender: Role of the entity that sends an encrypted payload.
* Recipient: Role of the entity that receives an encrypted payload.
Additionally, the following abbreviations are used in this document:
* Key Wrap (KW), defined in [RFC3394] (for use with AES)
* Key-Encryption Key (KEK) [RFC3394]
* Content-Encryption Key (CEK) [RFC5652]
* Ephemeral-Static (ES) Diffie-Hellman (DH) [RFC9052]
3. Architecture
[RFC9019] describes the architecture for distributing payloads and
manifests from an author to devices. It does, however, not detail
the use of payload encryption.
Tschofenig, et al. Expires 15 October 2023 [Page 4]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
This document enhances this architecture to support encryption. The
author and the distribution system are logical roles. In some
deployments these roles are separated in different physical entities
and in others they are co-located.
Figure 1 shows the distribution system, which represents the firmware
server and the device management infrastructure. The distribution
system is aware of the individual devices to which a payload has to
be delivered. The author is typically unaware which devices need to
receive these payloads.
To apply encryption the sender needs to know the recipient. For AES-
KW the KEK needs to be known and, in case of ES-DH, the sender needs
to be in possession of the public key of the recipient. The DH
public key and parameters may be in the recipient's X.509 certificate
[RFC5280].
If the author delegates the task of identifying the recipients of the
payloads to the distribution system, it needs to trust it with the
appropriate protection of the plaintext firmware image before
encryption is performed.
+----------+
| |
| Author |
| |
+----------+ +----------+
| Device |---+ |
| | | | Firmware +
| | | | Manifest
+----------+ | |
| |
| +--------------+
| | |
+----------+ | Firmware + Manifest | Distribution |
| Device |---+------------------------| System |
| | | | |
| | | | |
+----------+ | +--------------+
|
|
+----------+ |
| Device +---+
| |
| |
+----------+
Figure 1: Firmware Encryption Architecture.
Tschofenig, et al. Expires 15 October 2023 [Page 5]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
To offer confidentiality protection two deployment variants need to
be supported:
* The author, as the sender, transmits the encrypted payload to a
single device, or to multiple devices. The device(s) perform
decryption and act as recipients.
* The author treats the distribution system as the initial
recipient. Then, the distribution system decrypts and re-encrypts
the payload for consumption by the device (or the devices).
Delegating the task of re-encrypting the payload to the
distribution system offers flexiblity when the number of devices
that need to receive encrypted payloads changes dynamically or
when updates to KEKs or recipient public keys are necessary. As a
downside, the author needs to trust the distribution system with
performing the re-encryption of the payload.
For both variants the key distribution data, which is embedded inside
the COSE_Encrypt structure, is included in the SUIT manifest.
4. New Extensions
This specification introduces two extensions to the SUIT_Parameters
structure.
* A SUIT encryption info parameter (called suit-parameter-
encryption-info), see Figure 2, which contains key distribution
information. It is carried within the suit-directive-override-
parameters or the suit-directive-set-parameters structure. The
content of the SUIT_Encryption_Info structure is explained in
Section 6.1 (for AES-KW) and Section 6.2 (for ECDH-ES). An
implementation claiming conformance with this specification must
implement support for this parameter. A device may, however,
support only one of the available key distribution techniques.
* A CEK verification parameter (called suit-parameter-cek-
verification), see Figure 2, is utilized in environments where
battery exhaustion attacks are a concern. Details about the CEK
verification can be found in Section 7. This parameter is
optional to implement and use.
SUIT_Parameters //= (suit-parameter-encryption-info
=> bstr .cbor SUIT_Encryption_Info)
SUIT_Parameters //= (suit-parameter-cek-verification => bstr)
suit-parameter-encryption-info = [TBD1: Proposed 19]
suit-parameter-cek-verification = [TBD2: Proposed 20]
Tschofenig, et al. Expires 15 October 2023 [Page 6]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
Figure 2: Extended SUIT_Parameters CDDL.
5. Extended Directives
This specification extends these directives:
* Directive Write (suit-directive-write) to decrypt the content
specified by suit-parameter-content with suit-parameter-
encryption-info.
* Directive Copy (suit-directive-copy) to decrypt the content of the
component specified by suit-parameter-source-component with suit-
parameter-encryption-info.
/ directive-override-parameters / 20, {
/ parameter-content / 18: h'EA1CED',
/ parameter-encryption-info / 19: h'D860E1A1F0'
},
/ directive-write / 18, 15
/ NOTE: decrypt h'EA1CED' using h'D860E1A1F0' /
/ NOTE: plaintext payload is stored into component #0 /
Figure 3: Extended suit-directive-write example.
/ directive-set-component-index / 12, 1,
/ directive-override-parameters / 20, {
/ parameter-uri / 21: "http://example.com/encrypted.bin",
},
/ directive-fetch / 21, 15,
/ NOTE: encrypted payload is stored into component #1 /
/ directive-set-component-index / 12, 0,
/ directive-override-parameters / 20, {
/ parameter-source-component / 22: 1,
/ parameter-encryption-info / 19: h'D860E1A1F0'
},
/ directive-copy / 22, 15
/ NOTE: decrypt component #1 using h'D860E1A1F0' /
/ NOTE: plaintext payload is stored into component #0 /
Figure 4: Extended suit-directive-copy example.
6. Content Key Distribution Methods
The sub-sections below describe two content key distribution
mechanisms, namely AES Key Wrap (AES-KW) and Ephemeral-Static Diffie-
Hellman (ES-DH). Other mechanisms are supported by COSE and may be
supported via enhancements to this specification.
Tschofenig, et al. Expires 15 October 2023 [Page 7]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
When an encrypted firmware image is sent to multiple recipients,
there are different deployment options. To explain these options we
use the following notation:
* KEK(R1,S) refers to a KEK shared between recipient R1 and the
sender S. The KEK, as a concept, is used by AES Key Wrap.
* CEK(R1,S) refers to a CEK shared between R1 and S.
* CEK(_,S) or KEK(_,S) are used when a single CEK or a single KEK is
shared with all authorized recipients by a given sender S in a
certain context.
* ENC(plaintext, k) refers to the encryption of plaintext with a key
k.
* KEK_i or CEK_i refers to the i-th instance of the KEK or CEK,
respectively.
6.1. Content Key Distribution with AES Key Wrap
6.1.1. Introduction
The AES Key Wrap (AES-KW) algorithm is described in RFC 3394
[RFC3394], and can be used to encrypt a randomly generated content-
encryption key (CEK) with a pre-shared key-encryption key (KEK). The
COSE conventions for using AES-KW are specified in Section 8.5.2 of
[RFC9052] and in Section 6.2.1 of [RFC9053]. The encrypted CEK is
carried in the COSE_recipient structure alongside the information
needed for AES-KW. The COSE_recipient structure, which is a
substructure of the COSE_Encrypt structure, contains the CEK
encrypted by the KEK.
The COSE_Encrypt structure conveys information for encrypting the
payload, which includes information like the algorithm and the IV,
even though the payload is not embedded in the
COSE_Encrypt.ciphertext itself since it conveyed as detached content.
6.1.2. Deployment Options
There are three deployment options for use with AES Key Wrap for
payload encryption:
* If all authorized recipients have access to the KEK, a single
COSE_recipient structure contains the encrypted CEK. The sender
executes the following steps:
Tschofenig, et al. Expires 15 October 2023 [Page 8]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
Fetch KEK(*,S)
Generate CEK
ENC(CEK,KEK)
ENC(payload,CEK)
* If recipients have different KEKs, then multiple COSE_recipient
structures are included but only a single CEK is used. Each
COSE_recipient structure contains the CEK encrypted with the KEKs
appropriate for a given recipient. The benefit of this approach
is that the payload is encrypted only once with a CEK while there
is no sharing of the KEK across recipients. Hence, authorized
recipients still use their individual KEK to decrypt the CEK and
to subsequently obtain the plaintext. The steps taken by the
sender are:
Generate CEK
for i=1 to n {
Fetch KEK_i(Ri, S)
ENC(CEK, KEK_i)
}
ENC(payload,CEK)
* The third option is to use different CEKs encrypted with KEKs of
authorized recipients. Assume there are n recipients with their
unique KEKs - KEK_1(R1, S),..., KEK_n(Rn, S). The sender needs to
make the following steps:
for i=1 to n {
Fetch KEK_i(Ri, S)
Generate CEK_i
ENC(CEK_i, KEK_i)
ENC(payload,CEK_i)
}
This approach is appropriate when no benefits can be gained from
encrypting and transmitting payloads only once.
6.1.3. CDDL
The CDDL for the COSE_Encrypt_Tagged structure is shown in Figure 5.
Tschofenig, et al. Expires 15 October 2023 [Page 9]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
COSE_Encrypt_Tagged = #6.96(COSE_Encrypt)
SUIT_Encryption_Info = COSE_Encrypt_Tagged
COSE_Encrypt = [
protected : bstr .cbor outer_header_map_protected,
unprotected : outer_header_map_unprotected,
ciphertext : bstr / nil,
recipients : [ + COSE_recipient ]
]
outer_header_map_protected =
{
1 => int, ; algorithm identifier
* label =values ; extension point
}
outer_header_map_unprotected =
{
5 => bstr, ; IV
* label =values ; extension point
}
COSE_recipient = [
protected : bstr .size 0,
unprotected : recipient_header_map,
ciphertext : bstr ; CEK encrypted with KEK
]
recipient_header_map =
{
1 => int, ; algorithm identifier
4 => bstr, ; key identifier
* label =values ; extension point
}
Figure 5: CDDL for AES-KW-based Content Key Distribution
Note that the AES-KW algorithm, as defined in Section 2.2.3.1 of
[RFC3394], does not have public parameters that vary on a per-
invocation basis. Hence, the protected parameter in the
COSE_recipient structure is a byte string of zero length.
The COSE specification requires a consistent byte stream for the
authenticated data structure to be created. This structure is
replaced in Figure 6.
Tschofenig, et al. Expires 15 October 2023 [Page 10]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
Enc_structure = [
context : "Encrypt",
protected : empty_or_serialized_map,
external_aad : bstr
]
Figure 6: CDDL for Enc_structure Data Structure
This Enc_structure needs to be populated as follows:
The protected field in the Enc_structure from Figure 6 refers to the
content of the protected field from the COSE_Encrypt structure. It
is important to note that there are two protected fields shown in
Figure 5:
* one in the COSE_Encrypt structure, and
* a second one in the COSE_recipient structure.
The value of the external_aad MUST be set to a null value (major type
7, value 22).
6.1.4. Example
This example uses the following parameters:
* Algorithm for payload encryption: AES-GCM-128
* Algorithm id for key wrap: A128KW
* IV: 0x26, 0x68, 0x23, 0x06, 0xd4, 0xfb, 0x28, 0xca, 0x01, 0xb4,
0x3b, 0x80
* KEK: "aaaaaaaaaaaaaaaa"
* KID: "kid-1"
* Plaintext firmware (txt): "This is a real firmware image." (in
hex): 546869732069732061207265616C206669726D7761726520696D6167652E
The COSE_Encrypt structure, in hex format, is (with a line break
inserted):
D8608443A10101A1054C26682306D4FB28CA01B43B80F68340A2012204456B69642D
315818AF09622B4F40F17930129D18D0CEA46F159C49E7F68B644D
The resulting COSE_Encrypt structure in a diagnostic format is shown
in Figure 7.
Tschofenig, et al. Expires 15 October 2023 [Page 11]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
96([
/ protected: / << {
/ alg / 1: 1 / AES-GCM-128 /
} >>,
/ unprotected: / {
/ IV / 5: h'1de460e8b5b68d7222c0d6f20484d8ab'
},
/ payload: / null / detached ciphertext /,
/ recipients: / [
[
/ protected: / << {
} >>,
/ unprotected: / {
/ alg / 1: -3 / A128KW /,
/ kid / 4: 'kid-1'
},
/ payload: CEK encrypted with KEK /
h'a86200e4754733e4c00fc08c6a72cc1996e129922eab504f'
]
]
])
Figure 7: COSE_Encrypt Example for AES Key Wrap
The CEK, in hex format, was "4C805F1587D624ED5E0DBB7A7F7FA7EB". The
encrypted firmware (with a line feed added) was:
A8B6E61EF17FBAD1F1BF3235B3C64C06098EA512223260
F9425105F67F0FB6C92248AE289A025258F06C2AD70415
6.2. Content Key Distribution with Ephemeral-Static Diffie-Hellman
6.2.1. Introduction
Ephemeral-Static Diffie-Hellman (ES-DH) is a scheme that provides
public key encryption given a recipient's public key. There are
multiple variants of this scheme; this document re-uses the variant
specified in Section 8.5.5 of [RFC9052].
The following three layer structure is used:
* Layer 0: Has a content encrypted with the CEK. The content may be
detached.
* Layer 1: Uses the AES Key Wrap algorithm to encrypt a randomly
generated CEK with the KEK derived by layer 2.
Tschofenig, et al. Expires 15 October 2023 [Page 12]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
* Layer 2: Uses ECDH Ephemeral-Static direct to generate the KEK for
layer 1.
As a result, the three layers combine ECDH-ES with AES-KW. An
example is given in Appendix B of RFC 9052 and in Figure 9.
6.2.2. Deployment Options
There are two deployment options with this approach. We assume that
recipients are always configured with a device-unique public /
private key pair.
* A sender wants to transmit a payload to multiple recipients. All
recipients shall receive the same encrypted payload, i.e. the same
CEK is used. One COSE_recipient structure per recipient is used
and it contains the CEK encrypted with the KEK. To generate the
KEK each COSE_recipient structure contains a COSE_recipient_inner
structure to carry the sender's emphemeral key and an identifier
for the recipients public key.
The steps taken by the sender are:
Generate CEK
for i=1 to n {
Generate KEK_i(Ri, S) using ES-DH
ENC(CEK, KEK_i)
}
ENC(payload,CEK)
* The alternative is to encrypt a payload with a different CEK for
each recipient. Assume there are KEK_1(R1, S),..., KEK_n(Rn, S)
have been generated for the different recipients using ES-DH. The
following steps needs to be made by the sender:
for i=1 to n {
Generate KEK_i(Ri, S) using ES-DH
Generate CEK_i
ENC(CEK_i, KEK_i)
ENC(payload,CEK_i)
}
This results in n-manifests. This approach is useful when payloads
contain information unique to a device. The encryption operation
effectively becomes ENC(payload_i,CEK_i).
Tschofenig, et al. Expires 15 October 2023 [Page 13]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
6.2.3. CDDL
The CDDL for the COSE_Encrypt_Tagged structure is shown in Figure 8.
COSE_Encrypt_Tagged = #6.96(COSE_Encrypt)
SUIT_Encryption_Info = COSE_Encrypt_Tagged
COSE_Encrypt = [
protected : bstr .cbor outer_header_map_protected,
unprotected : outer_header_map_unprotected,
ciphertext : bstr / nil,
recipients : [ + COSE_recipient ]
]
outer_header_map_protected =
{
1 => int, ; algorithm identifier
* label =values ; extension point
}
outer_header_map_unprotected =
{
5 => bstr, ; IV
* label =values ; extension point
}
COSE_recipient = [
protected : bstr .size 0,
unprotected : recipient_header_map,
ciphertext : bstr ; CEK encrypted with KEK
recipients : [ + COSE_recipient_inner ]
]
recipient_header_map =
{
1 => int, ; algorithm identifier for key wrap
4 => bstr, ; key identifier
* label =values ; extension point
}
COSE_recipient_inner = [
protected : bstr .cbor inner_recipient_header_pr_map,
unprotected : inner_recipient_header_unpr_map,
ciphertext : nil
]
inner_recipient_header_pr_map =
Tschofenig, et al. Expires 15 October 2023 [Page 14]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
{
1 => int, ; algorithm identifier for ES-DH
* label =values ; extension point
}
inner_recipient_header_unpr_map =
{
1 => int, ; algorithm identifier
-1 => COSE_Key, ; ephemeral public key for the sender
4 => bstr, ; identifier of the recipient public key
* label =values ; extension point
}
Figure 8: CDDL for ES-DH-based Content Key Distribution
6.2.4. Example
This example uses the following parameters:
* Algorithm for payload encryption: AES-GCM-128
* Algorithm id for key wrap: A128KW
* Algorithm for ES-DH: ECDH-ES + HKDF-256
* IV: 0x26, 0x68, 0x23, 0x06, 0xd4, 0xfb, 0x28, 0xca, 0x01, 0xb4,
0x3b, 0x80
* KID: "kid-1"
* Plaintext: "This is a real firmware image."
* Firmware (hex):
546869732069732061207265616C206669726D7761726520696D6167652E
The COSE_Encrypt structure, in hex format, is (with a line break
inserted):
D8608443A10101A1054C26682306D4FB28CA01B43B80F6818440A101225
818DBD43C4E9D719C27C6275C67D628D493F090593DB8218F11818344A1
013818A220A401022001215820B2ADD44368EA6D641F9CA9AF308B4079A
EB519F11E9B8A55A600B21233E86E6822F404456B69642D3140
The resulting COSE_Encrypt structure in a diagnostic format is shown
in Figure 7.
Tschofenig, et al. Expires 15 October 2023 [Page 15]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
96(
[
/ protected / h'a10101' / {
\ alg \ 1:1 \ AES-GCM-128 \
} / ,
/ unprotected / {
/ iv / 5:h'26682306D4FB28CA01B43B80'
},
/ null value due to detached ciphertext /
null,
/ recipients / [
[
/ protected / h'',
/ unprotected / {
/ alg / 1:-3 / A128KW /
},
/ ciphertext - CEK encrypted with KEK /
h'dbd43c4e9d719c27c6275c67d628d493f090593db8218f11',
/ recipients-inner / [
[
/ protected / h'a1013818' / {
\ alg \ 1:-25 \ ECDH-ES + HKDF-256 \
} / ,
/ unprotected / {
/ ephemeral / -1:{
/ kty / 1:2,
/ crv / -1:1,
/ x / -2:h'b2add44368ea6d641f9ca9af308b4079
aeb519f11e9b8a55a600b21233e86e68',
/ y / -3:false
},
/ kid / 4:'kid-1'
},
/ ciphertext / h''
]
]
]
]
]
)
Figure 9: COSE_Encrypt Example for ES-DH
Tschofenig, et al. Expires 15 October 2023 [Page 16]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
7. CEK Verification
While the SUIT manifest is integrity protected and authenticated, the
SUIT envelope is not protected cryptographically. Hence, an
adversary located along the communication path between the sender and
the recipient could modify the COSE_Encrypt structure (assuming that
no other communication security mechanism is in use).
For example, if the attacker alters the key distribution data then a
recipient will decrypt the firmware image with an incorrect key.
This will lead to expending energy and flash cycles until the failure
is detected.
To mitigate this attack, a new parameter, called suit-cek-
verification, is added to the manifest. The suit-cek-verification
parameter is optional to implement and optional to use. When used,
it reduces the risk of a battery exhaustion attack against the IoT
device.
Since the manifest is protected by a digital signature or a MAC, an
adversary cannot successfully modify this value. This parameter
allows the recipient to verify whether the CEK has successfully been
derived.
The suit-cek-verification parameter contains a byte string resulting
from the encryption of 8 bytes of 0xA5 using the CEK with a nonce of
all zeros and empty additional data using the cipher algorithm and
mode also used to encrypt the plaintext. The same nonce used for CEK
verification MUST NOT be used to encrypt plaintext with the same CEK.
8. Firmware Updates on IoT Devices with Flash Memory.
Flash memory on microcontrollers is a type of non-volatile memory
that erases data in units called blocks, pages or sectors and re-
writes data at byte level (often 4-bytes). Flash memory is
furthermore segmented into different memory regions, which store the
bootloader, different versions of firmware images (in so-called
slots), and configuration data. Figure 10 shows an example layout of
a microcontroller flash area. The primary slot contains the firmware
image to be executed by the bootloader, which is a common deployment
on devices that do not offer the concept of position independent
code.
When the encrypted firmware image has been transferred to the device,
it will typically be stored in a staging area, in the secondary slot
in our example.
Tschofenig, et al. Expires 15 October 2023 [Page 17]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
At the next boot, the bootloader will recognize a new firmware image
in the secondary slot and will start decrypting the downloaded image
sector-by-sector and will swap it with the image found in the primary
slot.
The swap should only take place after the signature on the plaintext
is verified. Note that the plaintext firmware image is available in
the primary slot only after the swap has been completed, unless
"dummy decrypt" is used to compute the hash over the plaintext prior
to executing the decrypt operation during a swap. Dummy decryption
here refers to the decryption of the firmware image found in the
secondary slot sector-by-sector and computing a rolling hash over the
resulting plaintext firmware image (also sector-by-sector) without
performing the swap operation. While there are performance
optimizations possible, such as conveying hashes for each sector in
the manifest rather than a hash of the entire firmware image, such
optimizations are not described in this specification.
This approach of swapping the newly downloaded image with the
previously valid image is often referred as A/B approach. A/B refers
to the two slots involved. Two slots are used to allow the update to
be reversed in case the newly obtained firmware image fails to boot.
This approach adds robustness to the firmware update procedure.
Since the image in primary slot is available in cleartext it may need
to re-encrypted it before copying it to the secondary slot. This may
be necessary when the secondary slot has different access permissions
or when the staging area is located in an off-chip flash memory and
therefore more vulnerable to physical attacks. Note that this
description assumes that the processor does not execute encrypted
memory (i.e. using on-the-fly decryption in hardware).
Tschofenig, et al. Expires 15 October 2023 [Page 18]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
+--------------------------------------------------+
| Bootloader |
+--------------------------------------------------+
| Primary Slot |
| (sector 1)|
|..................................................|
| |
| (sector 2)|
|..................................................|
| |
| (sector 3)|
|..................................................|
| |
| (sector 4)|
+--------------------------------------------------+
| Secondary Slot |
| (sector 1)|
|..................................................|
| |
| (sector 2)|
|..................................................|
| |
| (sector 3)|
|..................................................|
| |
| (sector 4)|
+--------------------------------------------------+
| Swap Area |
| |
+--------------------------------------------------+
| Configuration Data |
+--------------------------------------------------+
Figure 10: Example Flash Area Layout
The ability to restart an interrupted firmware update is often a
requirement for low-end IoT devices. To fulfill this requirement it
is necessary to chunk a firmware image into sectors and to encrypt
each sector individually using a cipher that does not increase the
size of the resulting ciphertext (i.e., by not adding an
authentication tag after each encrypted block).
When an update gets aborted while the bootloader is decrypting the
newly obtained image and swapping the sectors, the bootloader can
restart where it left off. This technique offers robustness and
better performance.
Tschofenig, et al. Expires 15 October 2023 [Page 19]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
For this purpose ciphers without integrity protection are used to
encrypt the firmware image. Integrity protection for the firmware
image must, however, be provided and the suit-parameter-image-digest,
defined in Section 8.4.8.6 of [I-D.ietf-suit-manifest], MUST be used.
[I-D.ietf-cose-aes-ctr-and-cbc] registers AES Counter mode (AES-CTR)
and AES Cipher Block Chaining (AES-CBC) ciphers that do not offer
integrity protection. These ciphers are useful for the use cases
that require firmware encryption on IoT devices. For many other use
cases where software packages, configuration information or
personalization data needs to be encrypted, the use of Authenticated
Encryption with Additional Data (AEAD) ciphers is preferred.
The following sub-sections provide further information about the
initialization vector (IV) selection for use with AES-CBC and AES-CTR
in the firmware encryption context. An IV MUST NOTE be re-used when
the same key is used. For this application, the IVs are not random
but rather based on the slot/sector-combination in flash memory. The
text below assumes that the block-size of AES is (much) smaller than
sector size. The typical sector-size of flash memory is in the order
of KiB. Hence, multiple AES blocks need to be decrypted until an
entire sector is completed.
8.1. AES-CBC
In AES-CBC a single IV is used for encryption of firmware belonging
to a single sector since individual AES blocks are chained toghether,
as shown in Figure 11. The numbering of sectors in a slot MUST start
with zero (0) and MUST increase by one with every sector till the end
of the slot is reached. The IV follows this numbering.
For example, let us assume the slot size of a specific flash
controller on an IoT device is 64 KiB, the sector size 4096 bytes (4
KiB) and AES-128-CBC uses an AES-block size of 128 bit (16 bytes).
Hence, sector 0 needs 4096/16=256 AES-128-CBC operations using IV 0.
If the firmware image fills the entire slot then that slot contains
16 sectors, i.e. IVs ranging from 0 to 15.
Tschofenig, et al. Expires 15 October 2023 [Page 20]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
P1 P2
| |
IV--(+) +-------(+)
| | |
| | |
+-------+ | +-------+
| | | | |
| | | | |
k--| E | | k--| E |
| | | | |
+-------+ | +-------+
| | |
+-----+ |
| |
| |
C1 C2
Legend:
Pi = Plaintext blocks
Ci = Ciphertext blocks
E = Encryption function
k = Symmetric key
(+) = XOR operation
Figure 11: AES-CBC Operation
8.2. AES-CTR
Unlike AES-CBC, AES-CTR uses an IV per AES operation, as shown in
Figure 12. Hence, when an image is encrypted using AES-CTR-128 or
AES-CTR-256, the IV MUST start with zero (0) and MUST be incremented
by one for each 16-byte plaintext block within the entire slot.
Using the previous example with a slot size of 64 KiB, the sector
size 4096 bytes and the AES plaintext block size of 16 byte requires
IVs from 0 to 255 in the first sector and 16 * 256 IVs for the
remaining sectors in the slot.
Tschofenig, et al. Expires 15 October 2023 [Page 21]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
IV1 IV2
| |
| |
| |
+-------+ +-------+
| | | |
| | | |
k--| E | k--| E |
| | | |
+-------+ +-------+
| |
P1--(+) P2--(+)
| |
| |
C1 C2
Legend:
See previous diagram.
Figure 12: AES-CTR Operation
9. Complete Examples
[[Editor's Note: Add examples for a complete manifest here (including
a digital signature), multiple recipients, encryption of manifests
(in comparison to firmware images).]]
The following manifests examplify how to deliver encrypted firmware
and its encryption info to devices.
The examples are signed using the following ECDSA secp256r1 key:
-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgApZYjZCUGLM50VBC
CjYStX+09jGmnyJPrpDLTz/hiXOhRANCAASEloEarguqq9JhVxie7NomvqqL8Rtv
P+bitWWchdvArTsfKktsCYExwKNtrNHXi9OB3N+wnAUtszmR23M4tKiW
-----END PRIVATE KEY-----
The corresponding public key can be used to verify these examples:
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEhJaBGq4LqqvSYVcYnuzaJr6qi/Eb
bz/m4rVlnIXbwK07HypLbAmBMcCjbazR14vTgdzfsJwFLbM5kdtzOLSolg==
-----END PUBLIC KEY-----
Each example uses SHA-256 as the digest function.
Tschofenig, et al. Expires 15 October 2023 [Page 22]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
9.1. AES Key Wrap Example with Write Directive
The following SUIT manifest requests a parser to write and to decrypt
the encrypted payload into a component with the suit-directive-write
directive.
The SUIT manifest in diagnostic notation (with line breaks added for
readability) is shown here:
/ SUIT_Envelope_Tagged / 107({
/ authentication-wrapper / 2: << [
<< [
/ digest-algorithm-id: / -16 / SHA256 /,
/ digest-bytes: /
h'21F91D0007458DED08ED6C3D6B9A6824
FE58100529DF05F5947BDD1FFF5DFBE9'
] >>,
<< / COSE_Sign1_Tagged / 18([
/ protected: / << {
/ algorithm-id / 1: -7 / ES256 /
} >>,
/ unprotected: / {},
/ payload: / null,
/ signature: /
h'B1614992A357783A6D35D7D77807D7DA
0F67E0CB5D0BDBFD592D9C45C5BDD3B6
828E3A7A1101B33D558EB7C5114D0571
22D69455972D9937A1000E8F10DD5A2E'
]) >>
] >>,
/ manifest / 3: << {
/ manifest-version / 1: 1,
/ manifest-sequence-number / 2: 1,
/ common / 3: << {
/ components / 2: [
[h'00'] / to be decrypted payload /,
]
} >>,
/ install / 17: << [
/ fetch encrypted firmware /
/ directive-override-parameters / 20, {
/ parameter-content / 18:
h'2b3765ff457dd98a4ba7130a40462b66
3c08198146d23f3a32094392ca5040c3
121c8e5f4c04d5a3d1d6171bcf362b',
/ parameter-encryption-info / 19: << 96([
/ protected: / << {
/ alg / 1: 1 / AES-GCM-128 /
Tschofenig, et al. Expires 15 October 2023 [Page 23]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
} >>,
/ unprotected: / {
/ IV / 5: h'1de460e8b5b68d7222c0d6f20484d8ab'
},
/ payload: / null / detached ciphertext /,
/ recipients: / [
[
/ protected: / << {
} >>,
/ unprotected: / {
/ alg / 1: -3 / A128KW /,
/ kid / 4: 'kid-1'
},
/ payload: /
h'a86200e4754733e4c00fc08c
6a72cc1996e129922eab504f'
/ CEK encrypted with KEK /
]
]
]) >>
},
/ decrypt encrypted firmware /
/ directive-write / 18, 15
/ consumes the SUIT_Encryption_Info above /,
/ verify decrypted firmware /
/ directive-override-parameters / 20, {
/ parameter-image-digest / 3: << [
/ digest-algorithm-id: / -16 / SHA-256 /,
/ digest-bytes: /
h'efe16b6a486ff25e9fb5fabf515e2bfc
3f38b405de377477b23275b53049b46b'
] >>,
/ parameter-image-size / 14: 31
},
/ condition-image-match / 3, 15
] >>
} >>
})
In hex format, the SUIT manifest is this:
Tschofenig, et al. Expires 15 October 2023 [Page 24]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
D86BA2025873825824822F582021F91D0007458DED08ED6C3D6B9A6824FE
58100529DF05F5947BDD1FFF5DFBE9584AD28443A10126A0F65840B16149
92A357783A6D35D7D77807D7DA0F67E0CB5D0BDBFD592D9C45C5BDD3B682
8E3A7A1101B33D558EB7C5114D057122D69455972D9937A1000E8F10DD5A
2E0358BBA4010102010346A102818141001158AB8814A212582F2B3765FF
457DD98A4BA7130A40462B663C08198146D23F3A32094392CA5040C3121C
8E5F4C04D5A3D1D6171BCF362B135843D8608443A10101A105501DE460E8
B5B68D7222C0D6F20484D8ABF6818341A0A2012204456B69642D315818A8
6200E4754733E4C00FC08C6A72CC1996E129922EAB504F120F14A2035824
822F5820EFE16B6A486FF25E9FB5FABF515E2BFC3F38B405DE377477B232
75B53049B46B0E181F030F
9.2. AES Key Wrap Example with Fetch + Copy Directives
The following SUIT manifest requests a parser to fetch the encrypted
payload and to stores it. Then, the payload is decrypt and stored
into another component with the suit-directive-copy directive. This
approach works well on constrained devices with execute-in-place
flash memory.
The SUIT manifest in diagnostic notation (with line breaks added for
readability) is shown here:
/ SUIT_Envelope_Tagged / 107({
/ authentication-wrapper / 2: << [
<< [
/ digest-algorithm-id: / -16 / SHA256 /,
/ digest-bytes: /
h'65576167AF903B981C419CDAC9B5F63C
3A697927CC7FBF81CD6E34F4A70BCB60'
] >>,
<< / COSE_Sign1_Tagged / 18([
/ protected: / << {
/ algorithm-id / 1: -7 / ES256 /
} >>,
/ unprotected: / {},
/ payload: / null,
/ signature: /
h'A8C807FF03015088492C9C3B0779A771
502639676E7D27C3D33E8432037FA9D1
FE948D3C4C82778A6E2B1ADA74287809
526014A2BACFDC64600F63847956AE6F'
]) >>
] >>,
/ manifest / 3: << {
/ manifest-version / 1: 1,
/ manifest-sequence-number / 2: 1,
/ common / 3: << {
Tschofenig, et al. Expires 15 October 2023 [Page 25]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
/ components / 2: [
[h'00'] / to be decrypted payload /,
[h'01'] / encrypted payload /
]
} >>,
/ install / 17: << [
/ fetch encrypted firmware /
/ directive-set-component-index / 12, 1 / [h'01'] /,
/ directive-override-parameters / 20, {
/ parameter-uri / 21:
"https://author.example.com/encrypted-firmware.bin",
/ parameter-image-size / 14: 47
},
/ directive-fetch / 21, 15,
/ decrypt encrypted firmware /
/ directive-set-component-index / 12, 0 / [h'00'] /,
/ directive-override-parameters / 20, {
/ parameter-source-component / 22: 1 / [h'01'] /,
/ parameter-encryption-info / 19: << 96([
/ protected: / << {
/ alg / 1: 1 / AES-GCM-128 /
} >>,
/ unprotected: / {
/ IV / 5: h'1de460e8b5b68d7222c0d6f20484d8ab'
},
/ payload: / null / detached ciphertext /,
/ recipients: / [
[
/ protected: / << {
} >>,
/ unprotected: / {
/ alg / 1: -3 / A128KW /,
/ kid / 4: 'kid-1'
},
/ payload: /
h'a86200e4754733e4c00fc08c
6a72cc1996e129922eab504f'
/ CEK encrypted with KEK /
]
]
]) >>
},
/ directive-copy / 22, 15
/ consumes the SUIT_Encryption_Info above /,
/ verify decrypted firmware /
/ directive-override-parameters / 20, {
Tschofenig, et al. Expires 15 October 2023 [Page 26]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
/ parameter-image-digest / 3: << [
/ digest-algorithm-id: / -16 / SHA-256 /,
/ digest-bytes: /
h'efe16b6a486ff25e9fb5fabf515e2bfc
3f38b405de377477b23275b53049b46b'
] >>,
/ parameter-image-size / 14: 31
},
/ condition-image-match / 3, 15
] >>
} >>
})
In hex format, the SUIT manifest is this:
D86BA2025873825824822F582065576167AF903B981C419CDAC9B5F63C3A
697927CC7FBF81CD6E34F4A70BCB60584AD28443A10126A0F65840A8C807
FF03015088492C9C3B0779A771502639676E7D27C3D33E8432037FA9D1FE
948D3C4C82778A6E2B1ADA74287809526014A2BACFDC64600F63847956AE
6F0358CDA4010102010349A102828141008141011158BA900C0114A21578
3168747470733A2F2F617574686F722E6578616D706C652E636F6D2F656E
637279707465642D6669726D776172652E62696E0E182F150F0C0014A216
01135843D8608443A10101A105501DE460E8B5B68D7222C0D6F20484D8AB
F6818341A0A2012204456B69642D315818A86200E4754733E4C00FC08C6A
72CC1996E129922EAB504F160F14A2035824822F5820EFE16B6A486FF25E
9FB5FABF515E2BFC3F38B405DE377477B23275B53049B46B0E181F030F
10. Security Considerations
The algorithms described in this document assume that the party
performing payload encryption
* shares a key-encryption key (KEK) with the recipient (for use with
the AES Key Wrap scheme), or
* is in possession of the public key of the recipient (for use with
ECDH-ES).
Both cases require some upfront communication interaction. This
interaction is likely provided by an IoT device management solution,
as described in [RFC9019].
For AES Key Wrap to provide high security it is important that the
KEK is of high entropy, and that implementations protect the KEK from
disclosure. Compromise of the KEK may result in the disclosure of
all key data protected with that KEK.
Tschofenig, et al. Expires 15 October 2023 [Page 27]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
Since the CEK is randomly generated, it must be ensured that the
guidelines for random number generation in [RFC8937] are followed.
In some cases third party companies analyse binaries for known
security vulnerabilities. With encrypted payloads this type of
analysis is prevented. Consequently, these third party companies
either need to be given access to the plaintext binary before
encryption or they need to become authorized recipients of the
encrypted payloads. In either case, it is necessary to explicitly
consider those third parties in the software supply chain when such a
binary analysis is desired.
11. IANA Considerations
IANA is asked to add two values to the SUIT_Parameters registry
established by [I-D.ietf-suit-manifest].
Label Name Reference
-----------------------------------------
TBD1 Encryption Info Section 4
TBD2 CEK Verification Section 4
[Editor's Note: - TBD1: Proposed 19 - TBD2: Proposed 20 ]
12. References
12.1. Normative References
[I-D.ietf-cose-aes-ctr-and-cbc]
Housley, R. and H. Tschofenig, "CBOR Object Signing and
Encryption (COSE): AES-CTR and AES-CBC", Work in Progress,
Internet-Draft, draft-ietf-cose-aes-ctr-and-cbc-03, 19
January 2023, <https://datatracker.ietf.org/doc/html/
draft-ietf-cose-aes-ctr-and-cbc-03>.
[I-D.ietf-suit-manifest]
Moran, B., Tschofenig, H., Birkholz, H., Zandberg, K., and
O. Rønningstad, "A Concise Binary Object Representation
(CBOR)-based Serialization Format for the Software Updates
for Internet of Things (SUIT) Manifest", Work in Progress,
Internet-Draft, draft-ietf-suit-manifest-22, 27 February
2023, <https://datatracker.ietf.org/doc/html/draft-ietf-
suit-manifest-22>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/rfc/rfc2119>.
Tschofenig, et al. Expires 15 October 2023 [Page 28]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
[RFC3394] Schaad, J. and R. Housley, "Advanced Encryption Standard
(AES) Key Wrap Algorithm", RFC 3394, DOI 10.17487/RFC3394,
September 2002, <https://www.rfc-editor.org/rfc/rfc3394>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/rfc/rfc8174>.
[RFC9052] Schaad, J., "CBOR Object Signing and Encryption (COSE):
Structures and Process", STD 96, RFC 9052,
DOI 10.17487/RFC9052, August 2022,
<https://www.rfc-editor.org/rfc/rfc9052>.
[RFC9053] Schaad, J., "CBOR Object Signing and Encryption (COSE):
Initial Algorithms", RFC 9053, DOI 10.17487/RFC9053,
August 2022, <https://www.rfc-editor.org/rfc/rfc9053>.
12.2. Informative References
[iana-suit]
Internet Assigned Numbers Authority, "IANA SUIT Manifest
Registry", 2023, <TBD>.
[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
Housley, R., and W. Polk, "Internet X.509 Public Key
Infrastructure Certificate and Certificate Revocation List
(CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008,
<https://www.rfc-editor.org/rfc/rfc5280>.
[RFC5652] Housley, R., "Cryptographic Message Syntax (CMS)", STD 70,
RFC 5652, DOI 10.17487/RFC5652, September 2009,
<https://www.rfc-editor.org/rfc/rfc5652>.
[RFC8937] Cremers, C., Garratt, L., Smyshlyaev, S., Sullivan, N.,
and C. Wood, "Randomness Improvements for Security
Protocols", RFC 8937, DOI 10.17487/RFC8937, October 2020,
<https://www.rfc-editor.org/rfc/rfc8937>.
[RFC9019] Moran, B., Tschofenig, H., Brown, D., and M. Meriac, "A
Firmware Update Architecture for Internet of Things",
RFC 9019, DOI 10.17487/RFC9019, April 2021,
<https://www.rfc-editor.org/rfc/rfc9019>.
[RFC9124] Moran, B., Tschofenig, H., and H. Birkholz, "A Manifest
Information Model for Firmware Updates in Internet of
Things (IoT) Devices", RFC 9124, DOI 10.17487/RFC9124,
January 2022, <https://www.rfc-editor.org/rfc/rfc9124>.
Tschofenig, et al. Expires 15 October 2023 [Page 29]
Internet-Draft Encrypted Payloads in SUIT Manifests April 2023
[ROP] Wikipedia, "Return-Oriented Programming", March 2023,
<https://en.wikipedia.org/wiki/Return-
oriented_programming>.
Appendix A. Acknowledgements
We would like to thank Henk Birkholz for his feedback on the CDDL
description in this document. Additionally, we would like to thank
Michael Richardson, Øyvind Rønningstad, Dave Thaler, and Carsten
Bormann for their review feedback. Finally, we would like to thank
Dick Brooks for making us aware of the challenges firmware encryption
imposes on binary analysis.
Authors' Addresses
Hannes Tschofenig
Email: hannes.tschofenig@gmx.net
Russ Housley
Vigil Security, LLC
Email: housley@vigilsec.com
Brendan Moran
Arm Limited
Email: Brendan.Moran@arm.com
David Brown
Linaro
Email: david.brown@linaro.org
Ken Takayama
SECOM CO., LTD.
Email: ken.takayama.ietf@gmail.com
Tschofenig, et al. Expires 15 October 2023 [Page 30]