Minutes IETF117: suit: Mon 22:30
minutes-117-suit-202307242230-00
Meeting Minutes | Software Updates for Internet of Things (suit) WG | |
---|---|---|
Date and time | 2023-07-24 22:30 | |
Title | Minutes IETF117: suit: Mon 22:30 | |
State | Active | |
Other versions | markdown | |
Last updated | 2023-08-09 |
Agenda for SUIT Working Group at IETF 117
Jabber: xmpp:suit@jabber.ietf.org?join
MeetEcho: https://www.meetecho.com/ietf117/suit
Etherpad: https://notes.ietf.org/notes-ietf-117-suit#
1) Logistics
- Agenda Bashing
- Minute Taker
- Jabber Scribe
- Bluesheets
2) Hackathon Summary
- Share things that were learned
Updated libcsuit -- a manifest processor and encoder for SUIT
implemented in C. Now supports encrypted payloads usinf ES-ECDH for key
management. Submitted SUIT Manifest example to the encryption draft.
3) SUIT Manifest Format
- draft-ietf-suit-manifest-22
- Submitted to IESG for Publication
- Revised I-D Needed to address AD Review
Sec AD provided detailed review comments. Some have been addressed, but
open issues remain. Hannes asks for help addressing those items recorded
in the issues list. Roman states he did not see anything show-stopping,
many comments around tightening things up. Authors suggested holding an
interim to address remaining comments.
4) SUIT Manifest Extensions for Multiple Trust Domains
- draft-ietf-suit-trust-domains-04
- In WG Last Call; is it ready for the IESG?
No functional modifications since IETF 116. Lots of editorial
modifications, though.
Three Manifest examples:
- Key delegation chain: author delegates right to sign manifest. Author
generates CWT with delegate entity's public key signed by author
- Process Dependency: A dependent Manifest refers dependency Manifest,
identifying with the digest of dependency
- Integrated Dependency: composite manifest
Fixed inconsistent terminology, CDDL, IANA considerations
Use Cases to be added to the intro
Document in WGLC, reviews are welcome.
Ned asks for volunteers for reviews in the next couple of days. David
volunteered.
5) Update Management Extensions for SUIT Manifests
- draft-ietf-suit-update-management-02
- Discuss open issues; get ready for WG Last Call
This document has been parked since the last meeting. Brendan asks if
there is interest in getting this done. If there is interest, the
document needs more authors and reviewers.
Russ: We were waiting for this to be ready for WGLC, but is not hearing
it is.
Brendan: Looking for comments, but thinks this is done
Ned: do you know of open issues?
Brendan: I'll look, but this one hasn't gotten as much attention as the
other drafts
6) Firmware Encryption with SUIT Manifests
- draft-ietf-suit-firmware-encryption-11
- Depends on draft-ietf-cose-aes-ctr-and-cbc, which is with the RFC
Editor - Depends on draft-isobe-cose-key-thumbprint
- Discuss open issues; get ready for WG Last Call
Since last IETF:
- improved wording
- removed leftover CEK verification functionality
- updated examples based on results of hackathon work prototyping with
t_cose
- switched to a two layer ES-DH structure, rather than three layer
- updated content information structure
- looking at examples from other content information structures:
KeyMint, DIDComm, LAMPS kemri
- Hannes suggests aligning with the content information structure in
LAMPS kemri
Next Steps
- update content information strucutre, if no objections
- update ES-DH example
- add complete SUIT Manifest example
Brendan: explained the pros and cons between the author performing the
encryption for all recipients and the use of a distribution system.
These are explained in the document now.
Russ: We'll do WGLC on this when when WGLC on the previous one ends.
Should be about 3 weeks from now.
Hannes: unless folks object to the updates to the content information
strucuture
Dave: any other concerns? (deafening silence)
7) Secure Reporting of Update Status
- draft-ietf-suit-report-06
- Discuss open issues; get ready for WG Last Call
Brendan recommends that a SUIT Report be an EAT Measurment
New text in draft describing a SUIT Report as a procedural record. A
Verifier can convert a SUIT Report from a measurement to measurement
result (MESRES). Needs the SUIT Report and all referenced manifests.
With these, can produce all the meaurements accepted by the SUIT
Processor and replecate them as an EAT mesres.
Other edits were minor clean up. Should be ready for WGLC.
Dave will confirm with other authors, and then start WGLC.
8) Strong Assertions of IoT Network Access Requirements
- draft-ietf-suit-mud-03
- Depends on draft-isobe-cose-key-thumbprint
- In WG Last Call; waiting for dependency to catch up
In WGLC. Some minor editorial changes and an update to the Subject Key
Identifier from RFC 7093 to I-D.isobe-cose-key-thumbprint. No other
outstanding issues. WGLC is supposed to end on this.
Dependency on adoption of cose-key-thumbprint has been removed (I think?
Someone fact check this).
9) Mandatory-to-Implement Algorithms for SUIT Manifests
- draft-ietf-suit-mti-01
- Discuss open issues; get ready for WG Last Call
No updates. Open issues have been resolved. Dropped dependency on cose
hpke. Holding off putting in anything related to new PQC algorithms,
since there are no standards for them. Added set of reverse direction
algorithms, so SUIT report can have its own set of protections. Brendan
thinks this is ready.
Hannes: need two small changes. IANA considerations section says "TBD",
I think you need one. Also, HPKE reference needs to be removed.
Brendan: Yes, will remove reference to HPKE until it is stabalized. Will
be done in next two weeks.
Dave W: Will run this one next in the series.
10) Any Other Business (if time permits)
Milestones were very out of date.
- proposed new milestones to wrap up drafts in WGLC by next IETF
meeting
- will hold milestones to move things along in the meantime
- should be talking about publication at IETF 118
Ned: optimistically, November IETF meeting should be last time we need
to schedule a SUIT slot.