Arm Limited

hannes.tschofenig@arm.com

Vigil Security, LLC

housley@vigilsec.com

Arm Limited

Brendan.Moran@arm.com

Linaro

david.brown@linaro.org

SECOM CO., LTD.

ken.takayama.ietf@gmail.com

Security SUIT Internet-Draft This document specifies techniques for encrypting software, firmware and personalization data by utilizing the IETF SUIT manifest. Key establishment is provided by hybrid public-key encryption (HPKE) and AES Key Wrap (AES-KW). HPKE uses public key cryptography while AES-KW uses a pre-shared key-encryption key. Encryption of the plaintext is accomplished with conventional symmetric key cryptography.

Vulnerabilities with Internet of Things (IoT) devices have raised the need for a reliable and secure firmware update mechanism that is also suitable for constrained devices. To protect firmware images the SUIT manifest format was developed . The SUIT manifest provides a bundle of metadata about the firmware for an IoT device, where to find the firmware image, and the devices to which it applies. The SUIT information model details the information that has to be offered by the SUIT manifest format. In addition to offering protection against modification, which is provided by a digital signature or a message authentication code, the firmware image may also be afforded confidentiality using encryption. Encryption prevents third parties, including attackers, from gaining access to the firmware binary. Hackers typically need intimate knowledge of the target firmware to mount their attacks. For example, return-oriented programming (ROP) requires access to the binary and encryption makes it much more difficult to write exploits. The SUIT manifest provides the data needed for authorized recipients of the firmware image to decrypt it. The firmware image is encrypted using a symmetric key. A symmetric key can be established using a variety of mechanisms; this document defines two approaches for use with the IETF SUIT manifest, namely: hybrid public-key encryption (HPKE), and AES Key Wrap (AES-KW) using a pre-shared key-encryption key (KEK). These choices reduce the number of possible key establishment options and thereby help increase interoperability between different SUIT manifest parser implementations. While the original motivating use case of this document was firmware encryption, SUIT manifests may require payloads other than firmware images to experience confidentiality protection, such as - software (other than firmware), - personalization data, - configuration data, - machine learning models, etc. Hence, the term payload is used to generically refer to those objects that may be subject to encryption.

The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “NOT RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. This document assumes familiarity with the IETF SUIT manifest , the SUIT information model and the SUIT architecture . The terms sender and recipient are defined in and have the following meaning: Sender: Role of the entity that sends an encrypted payload. Recipient: Role of the entity that receives an encrypted payload. Additionally, the following abbreviations are used in this document: Key Wrap (KW), defined in RFC 3394 for use with AES. Key-encryption key (KEK), a term defined in RFC 4949 . Content-encryption key (CEK), a term defined in RFC 2630 . Hybrid Public Key Encryption (HPKE), defined in .

describes the architecture for distributing payloads and manifests from an author to devices. It does, however, not detail the use of payload encryption. This document enhances this architecture to support encryption. The author and the distribution system are logical roles. In some deployments these roles are separated in different physical entities and in others they are co-located. shows the distribution system, which represents the firmware server and the device management infrastructure. The distribution system is aware of the individual devices to which a payload has to be delivered. The author is typically unaware which devices need to receive these payloads. To apply encryption the sender needs to know the recipient. For AES-KW the KEK needs to be known and, in case of HPKE, the sender needs to be in possession of the public key of the recipient. If the author delegates the task of identifying devices that are the recipients of the payloads to the distribution system, it needs to trust the delivery system to perform the encryption of the plaintext firmware image.

To offer confidentiality protection two deployment variants need to be supported: The author acts as the sender and the recipient is the device (or the devices). The author treats the distribution system as the initial recipient. Then, the distribution system decrypts and re-encrypts the payload for consumption by the device (or devices). Delegating the task of re-encrypting the payload to the distribution system offers flexiblity when the number of devices that need to receive encrypted payloads changes dynamically or when updates to KEKs or recipient public keys are necessary. As a downside, the author needs to trust the distribution system with performing the re-encryption of the payload. For both variants the key distribution data (embedded inside the COSE_Encrypt structure) is included in the SUIT envelope rather than in the SUIT manifest since the manifest will be digitally signed (or MACed) by the author. Details about the changes to the envelope and the manifest can be found in the next section.

This specification introduces two extensions to the SUIT envelope and the manifest structure, as motivated in . The SUIT envelope is enhanced with a key exchange payload, which is carried inside the suit-protection-wrappers parameter, see . One or multiple SUIT_Encryption_Info payload(s) are carried within the suit-protection-wrappers parameter. The content of the SUIT_Encryption_Info payload is explained in (for AES-KW) and in (for HPKE). When the encryption capability is used, the suit-protection-wrappers parameter MUST be included in the envelope.

bstr .cbor SUIT_Authentication, suit-manifest => bstr .cbor SUIT_Manifest, SUIT_Severable_Manifest_Members, suit-protection-wrappers => bstr .cbor { *(int/str) => [+ SUIT_Encryption_Info] } * SUIT_Integrated_Payload, * SUIT_Integrated_Dependency, * $$SUIT_Envelope_Extensions, * (int => bstr) } ]]>

The manifest is extended with a CEK verification parameter (called suit-cek-verification), see . This parameter is optional and is utilized in environments where battery exhaustion attacks are a concern. Details about the CEK verification can be found in .

1, suit-manifest-sequence-number => uint, suit-common => bstr .cbor SUIT_Common, ? suit-reference-uri => tstr, SUIT_Severable_Members_Choice, SUIT_Unseverable_Members, * $$SUIT_Manifest_Extensions, } SUIT_Parameters //= (suit-parameter-cek-verification => bstr) ]]>

The AES Key Wrap (AES-KW) algorithm is described in RFC 3394 , and it can be used to encrypt a randomly generated content-encryption key (CEK) with a pre-shared key-encryption key (KEK). The COSE conventions for using AES-KW are specified in Section 12.2.1 of . The encrypted CEK is carried in the COSE_recipient structure alongside the information needed for AES-KW. The COSE_recipient structure, which is a substructure of the COSE_Encrypt structure, contains the CEK encrypted by the KEK. When the firmware image is encrypted for use by multiple recipients, there are three options. We use the following notation KEK(R1,S) is the KEK shared between recipient R1 and the sender S. Likewise, CEK(R1,S) is shared between R1 and S. If a single CEK or a single KEK is shared with all authorized recipients R by a given sender S in a certain context then we use CEK(,S) or KEK(,S), respectively. The notation ENC(plaintext, key) refers to the encryption of plaintext with a given key. If all authorized recipients have access to the KEK, a single COSE_recipient structure contains the encrypted CEK. This means KEK(*,S) ENC(CEK,KEK), and ENC(payload,CEK). If recipients have different KEKs, then multiple COSE_recipient structures are included but only a single CEK is used. Each COSE_recipient structure contains the CEK encrypted with the KEKs appropriate for the recipient. In short, KEK_1(R1, S),…, KEK_n(Rn, S), ENC(CEK, KEK_i) for i=1 to n, and ENC(firmware,CEK). The benefit of this approach is that the payload is encrypted only once with a CEK while there is no sharing of the KEK across recipients. Hence, authorized recipients still use their individual KEKs to decrypt the CEK and to subsequently obtain the plaintext. The third option is to use different CEKs encrypted with KEKs of the authorized recipients. Assume there are KEK_1(R1, S),…, KEK_n(Rn, S), and for i=1 to n the following computations need to be made: ENC(CEK_i, KEK_i) and ENC(firmware,CEK_i). This approach is appropriate when no benefits can be gained from encrypting and transmitting payloads only once. For example, payloads may contain information unique to an instance of a device rather than information that is independent of a device instance and therefore applies to an entire class of devices. Note that the AES-KW algorithm, as defined in Section 2.2.3.1 of , does not have public parameters that vary on a per-invocation basis. Hence, the protected structure in the COSE_recipient is a byte string of zero length. The COSE_Encrypt conveys information for encrypting the payload, which includes information like the algorithm and the IV, even though the payload is not embedded in the COSE_Encrypt.ciphertext itself since it conveyed as detached content. The CDDL for the COSE_Encrypt_Tagged structure is shown in .

int, ; algorithm identifier * label =values ; extension point } outer_header_map_unprotected = { 5 => bstr, ; IV * label =values ; extension point } COSE_recipient = [ protected : bstr .size 0, unprotected : recipient_header_map, ciphertext : bstr ; CEK encrypted with KEK ] recipient_header_map = { 1 => int, ; algorithm identifier 4 => bstr, ; key identifier * label =values ; extension point } ]]>

The COSE specification requires a consistent byte stream for the authenticated data structure to be created, which is shown in .

As shown in , there are two protected fields: one protected field in the COSE_Encrypt structure and a second one in the COSE_recipient structure. The ‘protected’ field in the Enc_structure, see , refers to the content of the protected field from the COSE_Encrypt structure. The value of the external_aad MUST be set to null. The following example illustrates the use of the AES-KW algorithm with AES-128. We use the following parameters in this example: IV: 0x26, 0x68, 0x23, 0x06, 0xd4, 0xfb, 0x28, 0xca, 0x01, 0xb4, 0x3b, 0x80 KEK: “aaaaaaaaaaaaaaaa” KID: “kid-1” Plaintext: “This is a real firmware image.” Firmware (hex): 546869732069732061207265616C206669726D7761726520696D6167652E The COSE_Encrypt structure, in hex format, is (with a line break inserted):

The resulting COSE_Encrypt structure in a diagnostic format is shown in .

The CEK, in hex format, was “4C805F1587D624ED5E0DBB7A7F7FA7EB” and the encrypted firmware (with a line feed added) was:

Hybrid public-key encryption (HPKE) is a scheme that provides public key encryption of arbitrary-sized plaintexts given a recipient’s public key. For use with this specification the scheme works as follows: HPKE, which internally utilizes a non-interactive ephemeral-static Diffie-Hellman exchange to derive a shared secret, is used to encrypt a CEK. This CEK is subsequently used to encrypt the firmware image. Hence, the plaintext passed to HPKE is the randomly generated CEK. The output of the HPKE SealBase function is therefore the encrypted CEK along with HPKE encapsulated key (i.e., the ephemeral ECDH public key). Only the holder of recipient’s private key can decapsulate the CEK to decrypt the firmware. Key generation in HPKE is influenced by additional parameters, such as identity information. This approach allows all recipients to use the same CEK to decrypt the firmware image, in case there are multiple recipients, to fulfill a requirement for the efficient distribution of firmware images using a multicast or broadcast protocol. defines the use of HPKE with COSE and provides examples.

While the SUIT manifest is integrity protected and authenticated, the SUIT envelope is not protected cryptographically. Hence, an adversary located along the communication path between the sender and the recipient could modify the COSE_Encrypt structure (assuming that no other communication security mechanism is in use). For example, if the attacker alters the key distribution data then a recipient will decrypt the firmware image with an incorrect key. This will lead to expending energy and flash cycles until the failure is detected. To mitigate this attack, a new parameter, called suit-cek-verification, is added to the manifest. The suit-cek-verification parameter is optional to implement and optional to use. When used, it reduces the risk of a battery exhaustion attack against the IoT device. Since the manifest is protected by a digital signature (or a MAC), an adversary cannot successfully modify this value. This parameter allows the recipient to verify whether the CEK has successfully been derived. The suit-cek-verification parameter contains a byte string resulting from the encryption of 8 bytes of 0xA5 using the CEK with a nonce of all zeros and empty additional data using the cipher algorithm and mode also used to encrypt the plaintext. The same nonce used for CEK verification MUST NOT be used to encrypt plaintext with the same CEK.

Flash memory on microcontrollers is a type of non-volatile memory that erases data in units called blocks, pages or sectors and re-writes data at byte level (often 4-bytes). Flash memory is furthermore segmented into different memory regions, which store the bootloader, different versions of firmware images (in so-called slots), and configuration data. shows an example layout of a microcontroller flash area. The primary slot contains the firmware image to be executed by the bootloader, which is a common deployment on devices that do not offer the concept of position independent code. When the encrypted firmware image has been transferred to the device, it will typically be stored in a staging area, in the secondary slot in our example. At the next boot, the bootloader will recognize a new firmware image in the secondary slot and will start decrypting the downloaded image sector-by-sector and will swap it with the image found in the primary slot. The swap should only take place after the signature on the plaintext is verified. Note that the plaintext firmware image is available in the primary slot only after the swap has been completed, unless “dummy decrypt” is used to compute the hash over the plaintext prior to executing the decrypt operation during a swap. Dummy decryption here refers to the decryption of the firmware image found in the secondary slot sector-by-sector and computing a rolling hash over the resulting plaintext firmware image (also sector-by-sector) without performing the swap operation. While there are performance optimizations possible, such as conveying hashes for each sector in the manifest rather than a hash of the entire firmware image, such optimizations are not described in this specification. This approach of swapping the newly downloaded image with the previously valid image is often referred as A/B approach. A/B refers to the two slots involved. Two slots are used to allow the update to be reversed in case the newly obtained firmware image fails to boot. This approach adds robustness to the firmware update procedure. Since the image in primary slot is available in cleartext it may need to re-encrypted it before copying it to the secondary slot. This may be necessary when the secondary slot has different access permissions or when the staging area is located in an off-chip flash memory and therefore more vulnerable to physical attacks. Note that this description assumes that the processor does not execute encrypted memory (i.e. using on-the-fly decryption in hardware).

The ability to restart an interrupted firmware update is often a requirement for low-end IoT devices. To fulfill this requirement it is necessary to chunk a firmware image into sectors and to encrypt each sector individually using a cipher that does not increase the size of the resulting ciphertext (i.e., by not adding an authentication tag after each encrypted block). When an update gets aborted while the bootloader is decrypting the newly obtained image and swapping the sectors, the bootloader can restart where it left off. This technique offers robustness and better performance. For this purpose ciphers without integrity protection are used to encrypt the firmware image. Integrity protection for the firmware image must, however, be provided and the the suit-parameter-image-digest, defined in Section 8.4.8.6 of , MUST be used. registers AES Counter mode (AES-CTR) and AES Cipher Block Chaining (AES-CBC) ciphers that do not offer integrity protection. These ciphers are useful for the use cases that require firmware encryption on IoT devices. For many other use cases where software packages, configuration information or personalization data needs to be encrypted, the use of Authenticated Encryption with Additional Data (AEAD) ciphers is preferred. The following sub-sections provide further information about the initialization vector (IV) selection for use with AES-CBC and AES-CTR in the firmware encryption context. An IV MUST NOTE be re-used when the same key is used. For this application, the IVs are not random but rather based on the slot/sector-combination in flash memory. The text below assumes that the block-size of AES is (much) smaller than sector size. The typical sector-size of flash memory is in the order of KiB. Hence, multiple AES blocks need to be decrypted until an entire sector is completed.

In AES-CBC a single IV is used for encryption of firmware belonging to a single sector since individual AES blocks are chained toghether, as shown in . The numbering of sectors in a slot MUST start with zero (0) and MUST increase by one with every sector till the end of the slot is reached. The IV follows this numbering. For example, let us assume the slot size of a specific flash controller on an IoT device is 64 KiB, the sector size 4096 bytes (4 KiB) and AES-128-CBC uses an AES-block size of 128 bit (16 bytes). Hence, sector 0 needs 4096/16=256 AES-128-CBC operations using IV 0. If the firmware image fills the entire slot then that slot contains 16 sectors, i.e. IVs ranging from 0 to 15.

Unlike AES-CBC, AES-CTR uses an IV per AES operation, as shown in . Hence, when an image is encrypted using AES-CTR-128 or AES-CTR-256, the IV MUST start with zero (0) and MUST be incremented by one for each 16-byte plaintext block within the entire slot. Using the previous example with a slot size of 64 KiB, the sector size 4096 bytes and the AES plaintext block size of 16 byte requires IVs from 0 to 255 in the first sector and 16 * 256 IVs for the remaining sectors in the slot. The last IV used to encrypt data in the slot is therefore

[[Editor’s Note: Add examples for a complete manifest here (including a digital signature), multiple recipients, encryption of manifests (in comparison to firmware images).]]

The algorithms described in this document assume that the party performing payload encryption shares a key-encryption key (KEK) with the recipient (for use with the AES-Key Wrap scheme), or is in possession of the public key of the recipient (for use with HPKE). Both cases require some upfront communication interaction. This interaction is likely provided by an IoT device management solution, as described in . For AES-Key Wrap to provide high security it is important that the KEK is of high entropy, and that implementations protect the KEK from disclosure. Compromise of the KEK may result in the disclosure of all key data protected with that KEK. Since the CEK is randomly generated, it must be ensured that the guidelines for random number generation in are followed. In some cases third party companies analyse binaries for known security vulnerabilities. With encrypted payloads this type of analysis is prevented. Consequently, these third party companies either need to be given access to the plaintext binary before encryption or they need to become authorized recipients of the encrypted payloads. In either case, it is necessary to explicitly consider those third parties in the software supply chain when such a binary analysis is desired.

This document asks IANA to register new values into the COSE algorithm registry. The values are listed in .

In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. Concise Binary Object Representation (CBOR) is a data format designed for small code size and small message size. There is a need for the ability to have basic security services defined for this data format. This document defines the CBOR Object Signing and Encryption (COSE) protocol. This specification describes how to create and process signatures, message authentication codes, and encryption using CBOR for serialization. This specification additionally describes how to represent cryptographic keys using CBOR. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. This document describes a scheme for hybrid public key encryption (HPKE). This scheme provides a variant of public key encryption of arbitrary-sized plaintexts for a recipient public key. It also includes three authenticated variants, including one that authenticates possession of a pre-shared key and two optional ones that authenticate possession of a key encapsulation mechanism (KEM) private key. HPKE works for any combination of an asymmetric KEM, key derivation function (KDF), and authenticated encryption with additional data (AEAD) encryption function. Some authenticated variants may not be supported by all KEMs. We provide instantiations of the scheme using widely used and efficient primitives, such as Elliptic Curve Diffie-Hellman (ECDH) key agreement, HMAC-based key derivation function (HKDF), and SHA2.This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF. Arm Limited Arm Limited Fraunhofer SIT Inria This specification describes the format of a manifest. A manifest is a bundle of metadata about code/data obtained by a recipient (chiefly the firmware for an IoT device), where to find the that code/data, the devices to which it applies, and cryptographic information protecting the manifest. Software updates and Trusted Invocation both tend to use sequences of common operations, so the manifest encodes those sequences of operations, rather than declaring the metadata. Arm Limited Vigil Security, LLC Arm Limited This specification defines hybrid public-key encryption (HPKE) for use with CBOR Object Signing and Encryption (COSE). HPKE offers a variant of public-key encryption of arbitrary-sized plaintexts for a recipient public key. HPKE works for any combination of an asymmetric key encapsulation mechanism (KEM), key derivation function (KDF), and authenticated encryption with additional data (AEAD) encryption function. Authentication for HPKE in COSE is provided by COSE-native security mechanisms. Vigil Security, LLC Arm Limited The Concise Binary Object Representation (CBOR) data format is designed for small code size and small message size. CBOR Object Signing and Encryption (COSE) is specified in RFC 8152 to provide basic security services using the CBOR data format. This document specifies the conventions for using AES-CTR and AES-CBC as Content Encryption algorithms with COSE. Vulnerabilities in Internet of Things (IoT) devices have raised the need for a reliable and secure firmware update mechanism suitable for devices with resource constraints. Incorporating such an update mechanism is a fundamental requirement for fixing vulnerabilities, but it also enables other important capabilities such as updating configuration settings and adding new functionality.In addition to the definition of terminology and an architecture, this document provides the motivation for the standardization of a manifest format as a transport-agnostic means for describing and protecting firmware updates. Vulnerabilities with Internet of Things (IoT) devices have raised the need for a reliable and secure firmware update mechanism that is also suitable for constrained devices. Ensuring that devices function and remain secure over their service lifetime requires such an update mechanism to fix vulnerabilities, update configuration settings, and add new functionality.One component of such a firmware update is a concise and machine-processable metadata document, or manifest, that describes the firmware image(s) and offers appropriate protection. This document describes the information that must be present in the manifest. Randomness is a crucial ingredient for Transport Layer Security (TLS) and related security protocols. Weak or predictable "cryptographically secure" pseudorandom number generators (CSPRNGs) can be abused or exploited for malicious purposes. An initial entropy source that seeds a CSPRNG might be weak or broken as well, which can also lead to critical and systemic security problems. This document describes a way for security protocol implementations to augment their CSPRNGs using long-term private keys. This improves randomness from broken or otherwise subverted CSPRNGs.This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF. This document describes the Cryptographic Message Syntax. This syntax is used to digitally sign, digest, authenticate, or encrypt arbitrary messages. [STANDARDS-TRACK] This Glossary provides definitions, abbreviations, and explanations of terminology for information system security. The 334 pages of entries offer recommendations to improve the comprehensibility of written material that is generated in the Internet Standards Process (RFC 2026). The recommendations follow the principles that such writing should (a) use the same term or definition whenever the same concept is mentioned; (b) use terms in their plainest, dictionary sense; (c) use terms that are already well-established in open publications; and (d) avoid terms that either favor a particular vendor or favor a particular technology or mechanism over other, competing techniques that already exist or could be developed. This memo provides information for the Internet community. Internet Assigned Numbers Authority

We would like to thank Henk Birkholz for his feedback on the CDDL description in this document. Additionally, we would like to thank Michael Richardson, Dave Thaler, and Carsten Bormann for their review feedback. Finally, we would like to thank Dick Brooks for making us aware of the challenges firmware encryption imposes on binary analysis.