]>

hannes.tschofenig@gmx.net

Vigil Security, LLC

housley@vigilsec.com

Arm Limited

Brendan.Moran@arm.com

Linaro

david.brown@linaro.org

SECOM CO., LTD.

ken.takayama.ietf@gmail.com

Security SUIT Internet-Draft This document specifies techniques for encrypting software, firmware and personalization data by utilizing the IETF SUIT manifest. Key agreement is provided by ephemeral-static (ES) Diffie-Hellman (DH) and AES Key Wrap (AES-KW). ES-DH uses public key cryptography while AES-KW uses a pre-shared key-encryption key. Encryption of the plaintext is accomplished with conventional symmetric key cryptography.

Introduction Vulnerabilities with Internet of Things (IoT) devices have raised the need for a reliable and secure firmware update mechanism that is also suitable for constrained devices. To protect firmware images the SUIT manifest format was developed . The SUIT manifest provides a bundle of metadata about the firmware for an IoT device, where to find the firmware image, and the devices to which it applies. The SUIT information model details the information that has to be offered by the SUIT manifest format. In addition to offering protection against modification, which is provided by a digital signature or a message authentication code, the firmware image may also be afforded confidentiality using encryption. Encryption prevents third parties, including attackers, from gaining access to the firmware binary. Hackers typically need intimate knowledge of the target firmware to mount their attacks. For example, return-oriented programming (ROP) requires access to the binary and encryption makes it much more difficult to write exploits. The SUIT manifest provides the data needed for authorized recipients of the firmware image to decrypt it. The firmware image is encrypted using a symmetric key. A symmetric key can be established using a variety of mechanisms; this document defines two approaches for use with the IETF SUIT manifest, namely: Ephemeral-Static (ES) Diffie-Hellman (DH), and AES Key Wrap (AES-KW) with a pre-shared key-encryption key (KEK). The former relies on asymmetric key cryptography while the latter uses symmetric key cryptography for content key distribution. Our goal was to reduce the number of content key distribution options and thereby increase interoperability between different SUIT manifest parser implementations. While the original motivating use case of this document was firmware encryption, SUIT manifests may require payloads other than firmware images to experience confidentiality protection, such as software packages, personalization data, configuration data, and machine learning models. Hence, the term payload is used to generically refer to those objects that may be subject to encryption.

Conventions and Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. This document assumes familiarity with the IETF SUIT manifest , the SUIT information model and the SUIT architecture . The terms sender and recipient have the following meaning: Sender: Role of the entity that sends an encrypted payload. Recipient: Role of the entity that receives an encrypted payload. Additionally, we introduce the term "distribution system" (or distributor) to refer to an entity that knows the recipients of the firmware images. For use of encryption it therefore either knows the public key of the recipient (for ES-DH), or the KEK (for AES-KW). The author on the other hand does not know the recipients, which is responsible for creating the firmware image. It is important to note that the distribution system is far more than a file server. Finally, the following abbreviations are used in this document: Key Wrap (KW), defined in (for use with AES) Key-Encryption Key (KEK) Content-Encryption Key (CEK) Ephemeral-Static (ES) Diffie-Hellman (DH)

Architecture describes the architecture for distributing payloads and manifests from an author to devices. It does, however, not detail the use of payload encryption. This document enhances this architecture to support encryption. The author and the distribution system are logical roles. In some deployments these roles are separated in different physical entities and in others they are co-located. shows the distribution system, which represents the firmware server and the device management infrastructure. To apply encryption the sender (author) needs to know the recipient (device). For AES-KW the KEK needs to be known and, in case of ES-DH, the sender needs to be in possession of the public key of the recipient. The public key and parameters may be in the recipient's X.509 certificate . Furthermore, for ES-DH the recipients must be provisioned with a public key (or certificate) for digital signature verification of the manifest. With encryption the author cannot just create a manifest for the firmware image and sign it since the subsequent encryption step by the distribution system would invalidate the signature over the manifest. (The content key distribution information is embedded inside the COSE_Encrypt structure, which is included in the SUIT manifest.) Hence, the author has to collaborate with the distribution system. The varying degree of collaboration is discussed below.

The author has several deployment options, namely The author, as the sender, obtains information about the recipients and their keys from the distribution system. Then, it performs the necessary steps to encrypt the payload. As a last step it creates one or more manifests. The device(s)perform decryption and act as recipients. The author treats the distribution system as the initial recipient. Then, the distribution system decrypts and re-encrypts the payload for consumption by the device (or the devices). Delegating the task of re-encrypting the payload to the distribution system offers flexiblity when the number of devices that need to receive encrypted payloads changes dynamically or when updates to KEKs or recipient public keys are necessary. As a downside, the author needs to trust the distribution system with performing the re-encryption of the payload. If the author and distributor are separate entities, then the author must delegate encryption rights to the distributor. By the principle of least privilege, this should only grant the distributor decryption and re-encryption rights. There are two models: The distributor replaces the COSE_Encrypt in the manifest and then signs the manifest again. However, the COSE_Encrypt structure is contained within a signed container, which presents a problem: replacing the COSE_Encrypt with a new one will cause the digest of the manifest to change, thereby changing the signature. This means that the distributor must be able to sign the new manifest. If this is the case, then the distributor gains the ability to construct and sign manifests, which allows the distributor the authority to sign code, effectively presenting the distributor with full control over the recipient. The alternative is to use a two-manifest system, where the distributor constructs a new manifest that overrides the COSE_Encrypt using the dependency system defined in . This incurrs additional overhead: one additional signature verification and one additional manifest, as well as the additional machinery in the recipient needed for dependency processing. These two models also present different threat profiles for the distributor. If the distributor only has encryption rights, then an attacker who breaches the distributor can only mount a limited attack: they can encrypt a modified binary, but the recipients will identify the attack as soon as they perform the required image digest check and revert back to a correct image immediately. However, if the distributor has the authority to sign a single manifest, this threat profile is substantially degraded: a successful breach of the distributor grants the attacker the ability to distribute whatever code they like to recipient devices. The recipient will validate the signature of the code and run it without identifying the attack. Because distributors typically must perform their re-encryption online in order to handle a large number of devices in a timely fashion, it is not possible to air-gap the distributor's signing operations. This degrades the recommendations in , Section 4.3.17. It is strongly RECOMMENDED that distributors are implemented using a two-manifest system in order to distribute encryption keys without requiring re-signing of the manifest, despite the increase in complexity and greater number of signature verifications that this imposes on the recipient.

Encryption Extensions This specification introduces a new extension to the SUIT_Parameters structure. The SUIT encryption info parameter (called suit-parameter-encryption-info), see , contains key distribution information. It is carried inside the suit-directive-override-parameters or the suit-directive-set-parameters structure. The content of the SUIT_Encryption_Info structure is explained in (for AES-KW) and (for ECDH-ES). An implementation claiming conformance with this specification must implement support for this parameter. A device may, however, support only one of the available key distribution techniques.

bstr .cbor SUIT_Encryption_Info) suit-parameter-encryption-info = [TBD1: Proposed 19] ]]>

Extended Directives This specification extends these directives: Directive Write (suit-directive-write) to decrypt the content specified by suit-parameter-content with suit-parameter-encryption-info. Directive Copy (suit-directive-copy) to decrypt the content of the component specified by suit-parameter-source-component with suit-parameter-encryption-info. Examples of the two extensioned directives are shown in and in .

Content Key Distribution Methods The sub-sections below describe two content key distribution mechanisms, namely AES Key Wrap (AES-KW) and Ephemeral-Static Diffie-Hellman (ES-DH). Other mechanisms are supported by COSE and may be supported via enhancements to this specification. When an encrypted firmware image is sent to multiple recipients, there are different deployment options. To explain these options we use the following notation: KEK(R1,S) refers to a KEK shared between recipient R1 and the sender S. The KEK, as a concept, is used by AES Key Wrap. CEK(R1,S) refers to a CEK shared between R1 and S. CEK(,S) or KEK(,S) are used when a single CEK or a single KEK is shared with all authorized recipients by a given sender S in a certain context. ENC(plaintext, k) refers to the encryption of plaintext with a key k. KEK_i or CEK_i refers to the i-th instance of the KEK or CEK, respectively.

Content Key Distribution with AES Key Wrap

Introduction The AES Key Wrap (AES-KW) algorithm is described in RFC 3394 , and can be used to encrypt a randomly generated content-encryption key (CEK) with a pre-shared key-encryption key (KEK). The COSE conventions for using AES-KW are specified in Section 8.5.2 of and in Section 6.2.1 of . The encrypted CEK is carried in the COSE_recipient structure alongside the information needed for AES-KW. The COSE_recipient structure, which is a substructure of the COSE_Encrypt structure, contains the CEK encrypted by the KEK. The COSE_Encrypt structure conveys information for encrypting the payload, which includes information like the algorithm and the IV, even though the payload is not embedded in the COSE_Encrypt.ciphertext itself since it conveyed as detached content.

Deployment Options There are three deployment options for use with AES Key Wrap for payload encryption: If all authorized recipients have access to the KEK, a single COSE_recipient structure contains the encrypted CEK. The sender executes the following steps:

If recipients have different KEKs, then multiple COSE_recipient structures are included but only a single CEK is used. Each COSE_recipient structure contains the CEK encrypted with the KEKs appropriate for a given recipient. The benefit of this approach is that the payload is encrypted only once with a CEK while there is no sharing of the KEK across recipients. Hence, authorized recipients still use their individual KEK to decrypt the CEK and to subsequently obtain the plaintext. The steps taken by the sender are:

The third option is to use different CEKs encrypted with KEKs of authorized recipients. Assume there are n recipients with their unique KEKs - KEK_1(R1, S),..., KEK_n(Rn, S). The sender needs to make the following steps:

This approach is appropriate when no benefits can be gained from encrypting and transmitting payloads only once.

CDDL The CDDL for the COSE_Encrypt_Tagged structure is shown in .

int, ; algorithm identifier * label => values ; extension point } outer_header_map_unprotected = { 5 => bstr, ; IV * label => values ; extension point } COSE_recipient = [ protected : bstr .size 0, unprotected : recipient_header_map, ciphertext : bstr ; CEK encrypted with KEK ] recipient_header_map = { 1 => int, ; algorithm identifier 4 => bstr, ; key identifier * label => values ; extension point } ]]>

Note that the AES-KW algorithm, as defined in Section 2.2.3.1 of , does not have public parameters that vary on a per-invocation basis. Hence, the protected header in the COSE_recipient structure is a byte string of zero length. The COSE specification requires a consistent byte stream for the authenticated data structure to be created. This structure is shown in .

This Enc_structure needs to be populated as follows: The protected field in the Enc_structure from refers to the content of the protected field from the COSE_Encrypt structure. It is important to note that there are two protected fields shown in : one in the COSE_Encrypt structure, and a second one in the COSE_recipient structure. The value of the external_aad MUST be set to a null value (major type 7, value 22).

Example This example uses the following parameters: Algorithm for payload encryption: AES-GCM-128 Algorithm id for key wrap: A128KW IV: 0x26, 0x68, 0x23, 0x06, 0xd4, 0xfb, 0x28, 0xca, 0x01, 0xb4, 0x3b, 0x80 KEK: "aaaaaaaaaaaaaaaa" KID: "kid-1" Plaintext firmware (txt): "This is a real firmware image." (in hex): 546869732069732061207265616C206669726D7761726520696D6167652E The COSE_Encrypt structure, in hex format, is (with a line break inserted):

The resulting COSE_Encrypt structure in a diagnostic format is shown in .

>, / unprotected: / { / IV / 5: h'1de460e8b5b68d7222c0d6f20484d8ab' }, / payload: / null / detached ciphertext /, / recipients: / [ [ / protected: / << { } >>, / unprotected: / { / alg / 1: -3 / A128KW /, / kid / 4: 'kid-1' }, / payload: CEK encrypted with KEK / h'a86200e4754733e4c00fc08c6a72cc1996e129922eab504f' ] ] ]) ]]>

The CEK, in hex format, was "4C805F1587D624ED5E0DBB7A7F7FA7EB". The encrypted firmware (with a line feed added) was:

Content Key Distribution with Ephemeral-Static Diffie-Hellman

Introduction Ephemeral-Static Diffie-Hellman (ES-DH) is a scheme that provides public key encryption given a recipient's public key. There are multiple variants of this scheme; this document re-uses the variant specified in Section 8.5.5 of . The following two layer structure is used: Layer 0: Has a content encrypted with the CEK. The content may be detached. Layer 1: Uses the AES Key Wrap algorithm to encrypt a randomly generated CEK with the KEK derived with ECDH Ephemeral-Static whereby the resulting symmetric key is fed into the HKDF-based key derivation function. As a result, the two layers combine ECDH-ES with AES-KW and HKDF. An example is given in .

Deployment Options There are two deployment options with this approach. We assume that recipients are always configured with a device-unique public / private key pair. A sender wants to transmit a payload to multiple recipients. All recipients shall receive the same encrypted payload, i.e. the same CEK is used. One COSE_recipient structure per recipient is used and it contains the CEK encrypted with the KEK. To generate the KEK each COSE_recipient structure contains a COSE_recipient_inner structure to carry the sender's emphemeral key and an identifier for the recipients public key. The steps taken by the sender are:

The alternative is to encrypt a payload with a different CEK for each recipient. Assume there are KEK_1(R1, S),..., KEK_n(Rn, S) have been generated for the different recipients using ES-DH. The following steps needs to be made by the sender:

This results in n-manifests. This approach is useful when payloads contain information unique to a device. The encryption operation effectively becomes ENC(payload_i,CEK_i).

CDDL The CDDL for the COSE_Encrypt_Tagged structure is shown in .

int, ; algorithm identifier * label => values ; extension point } outer_header_map_unprotected = { 5 => bstr, ; IV * label => values ; extension point } COSE_recipient = [ protected : bstr .cbor recipient_header_pr_map, unprotected : recipient_header_unpr_map, ciphertext : bstr ; CEK encrypted with KEK ] recipient_header_pr_map = { 1 => int, ; algorithm identifier for key wrap * label => values ; extension point } recipient_header_unpr_map = { -1 => COSE_Key, ; ephemeral public key for the sender 4 => bstr, ; identifier of the recipient public key * label => values ; extension point } ]]>

Context Information Structure The context information structure is used to ensure that the derived keying material is "bound" to the context of the transaction. This specification re-uses the structure defined in Section 5.2 of RFC 9053 and tailors it accordingly. The following information elements are bound to the context: the hash of the public key of the sender, the hash of the public key of the recipient, the protocol employing the key-derivation method, information about the utilized algorithms (including the payload encryption algorithms, the content key encryption algorithm, and the key length). The following fields in require an explantation: The identity fields in the PartyInfoSender and the PartyInfoRecipient structures contain the COSE_Key Thumbprint of the public keys of the sender and the recipient, respectively. The details for computing these thumbprints are described in . The COSE_KDF_Context.AlgorithmID field contains the value found in the alg field of the protected header in the COSE_Encrypt structure. This is the content encryption algorithm identifier. The COSE_KDF_Context.SuppPubInfo.keyDataLength field contains the key length of the algorithm in the alg field of the protected header in the COSE_Encrypt structure expressed as the number of bits. The COSE_KDF_Context.SuppPubInfo.other field captures the protocol in which the ES-DH content key distribution algorithm is used and it is set to the constant string "SUIT Payload Encryption". The COSE_KDF_Context.SuppPubInfo.protected field serializes the content of the recipient_header_pr_map field, which contains the content key distribution algorithm identifier.

Example This example uses the following parameters: Algorithm for payload encryption: AES-GCM-128 IV: 0x26, 0x68, 0x23, 0x06, 0xd4, 0xfb, 0x28, 0xca, 0x01, 0xb4, 0x3b, 0x80 Algorithm for content key distribution: ECDH-ES + A128KW KID: "kid-1" Plaintext: "This is a real firmware image." Firmware (hex): 546869732069732061207265616C206669726D7761726520696D6167652E The COSE_Encrypt structure, in hex format, is (with a line break inserted):

The resulting COSE_Encrypt structure in a diagnostic format is shown in .

Firmware Updates on IoT Devices with Flash Memory Flash memory on microcontrollers is a type of non-volatile memory that erases data in units called blocks, pages or sectors and re-writes data at byte level (often 4-bytes). Flash memory is furthermore segmented into different memory regions, which store the bootloader, different versions of firmware images (in so-called slots), and configuration data. shows an example layout of a microcontroller flash area. The primary slot contains the firmware image to be executed by the bootloader, which is a common deployment on devices that do not offer the concept of position independent code. When the encrypted firmware image has been transferred to the device, it will typically be stored in a staging area, in the secondary slot in our example. At the next boot, the bootloader will recognize a new firmware image in the secondary slot and will start decrypting the downloaded image sector-by-sector and will swap it with the image found in the primary slot. The swap should only take place after the signature on the plaintext is verified. Note that the plaintext firmware image is available in the primary slot only after the swap has been completed, unless "dummy decrypt" is used to compute the hash over the plaintext prior to executing the decrypt operation during a swap. Dummy decryption here refers to the decryption of the firmware image found in the secondary slot sector-by-sector and computing a rolling hash over the resulting plaintext firmware image (also sector-by-sector) without performing the swap operation. While there are performance optimizations possible, such as conveying hashes for each sector in the manifest rather than a hash of the entire firmware image, such optimizations are not described in this specification. This approach of swapping the newly downloaded image with the previously valid image is often referred as A/B approach. A/B refers to the two slots involved. Two slots are used to allow the update to be reversed in case the newly obtained firmware image fails to boot. This approach adds robustness to the firmware update procedure. Since the image in primary slot is available in cleartext it may need to re-encrypted it before copying it to the secondary slot. This may be necessary when the secondary slot has different access permissions or when the staging area is located in an off-chip flash memory and therefore more vulnerable to physical attacks. Note that this description assumes that the processor does not execute encrypted memory (i.e. using on-the-fly decryption in hardware).

The ability to restart an interrupted firmware update is often a requirement for low-end IoT devices. To fulfill this requirement it is necessary to chunk a firmware image into sectors and to encrypt each sector individually using a cipher that does not increase the size of the resulting ciphertext (i.e., by not adding an authentication tag after each encrypted block). When an update gets aborted while the bootloader is decrypting the newly obtained image and swapping the sectors, the bootloader can restart where it left off. This technique offers robustness and better performance. For this purpose ciphers without integrity protection are used to encrypt the firmware image. Integrity protection for the firmware image must, however, be provided and the suit-parameter-image-digest, defined in Section 8.4.8.6 of , MUST be used. registers AES Counter mode (AES-CTR) and AES Cipher Block Chaining (AES-CBC) ciphers that do not offer integrity protection. These ciphers are useful for the use cases that require firmware encryption on IoT devices. For many other use cases where software packages, configuration information or personalization data needs to be encrypted, the use of Authenticated Encryption with Additional Data (AEAD) ciphers is preferred. The following sub-sections provide further information about the initialization vector (IV) selection for use with AES-CBC and AES-CTR in the firmware encryption context. An IV MUST NOTE be re-used when the same key is used. For this application, the IVs are not random but rather based on the slot/sector-combination in flash memory. The text below assumes that the block-size of AES is (much) smaller than sector size. The typical sector-size of flash memory is in the order of KiB. Hence, multiple AES blocks need to be decrypted until an entire sector is completed.

AES-CBC In AES-CBC a single IV is used for encryption of firmware belonging to a single sector since individual AES blocks are chained toghether, as shown in . The numbering of sectors in a slot MUST start with zero (0) and MUST increase by one with every sector till the end of the slot is reached. The IV follows this numbering. For example, let us assume the slot size of a specific flash controller on an IoT device is 64 KiB, the sector size 4096 bytes (4 KiB) and AES-128-CBC uses an AES-block size of 128 bit (16 bytes). Hence, sector 0 needs 4096/16=256 AES-128-CBC operations using IV 0. If the firmware image fills the entire slot then that slot contains 16 sectors, i.e. IVs ranging from 0 to 15.

AES-CTR Unlike AES-CBC, AES-CTR uses an IV per AES operation, as shown in . Hence, when an image is encrypted using AES-CTR-128 or AES-CTR-256, the IV MUST start with zero (0) and MUST be incremented by one for each 16-byte plaintext block within the entire slot. Using the previous example with a slot size of 64 KiB, the sector size 4096 bytes and the AES plaintext block size of 16 byte requires IVs from 0 to 255 in the first sector and 16 * 256 IVs for the remaining sectors in the slot.

Complete Examples The following manifests examplify how to deliver encrypted firmware and its encryption info to devices. The examples are signed using the following ECDSA secp256r1 key:

The corresponding public key can be used to verify these examples:

Each example uses SHA-256 as the digest function.

AES Key Wrap Example with Write Directive The following SUIT manifest requests a parser to write and to decrypt the encrypted payload into a component with the suit-directive-write directive. The SUIT manifest in diagnostic notation (with line breaks added for readability) is shown here:

>, << / COSE_Sign1_Tagged / 18([ / protected: / << { / algorithm-id / 1: -7 / ES256 / } >>, / unprotected: / {}, / payload: / null, / signature: / h'B1614992A357783A6D35D7D77807D7DA 0F67E0CB5D0BDBFD592D9C45C5BDD3B6 828E3A7A1101B33D558EB7C5114D0571 22D69455972D9937A1000E8F10DD5A2E' ]) >> ] >>, / manifest / 3: << { / manifest-version / 1: 1, / manifest-sequence-number / 2: 1, / common / 3: << { / components / 2: [ [h'00'] / to be decrypted payload /, ] } >>, / install / 17: << [ / fetch encrypted firmware / / directive-override-parameters / 20, { / parameter-content / 18: h'2b3765ff457dd98a4ba7130a40462b66 3c08198146d23f3a32094392ca5040c3 121c8e5f4c04d5a3d1d6171bcf362b', / parameter-encryption-info / 19: << 96([ / protected: / << { / alg / 1: 1 / AES-GCM-128 / } >>, / unprotected: / { / IV / 5: h'1de460e8b5b68d7222c0d6f20484d8ab' }, / payload: / null / detached ciphertext /, / recipients: / [ [ / protected: / << { } >>, / unprotected: / { / alg / 1: -3 / A128KW /, / kid / 4: 'kid-1' }, / payload: / h'a86200e4754733e4c00fc08c 6a72cc1996e129922eab504f' / CEK encrypted with KEK / ] ] ]) >> }, / decrypt encrypted firmware / / directive-write / 18, 15 / consumes the SUIT_Encryption_Info above /, / verify decrypted firmware / / directive-override-parameters / 20, { / parameter-image-digest / 3: << [ / digest-algorithm-id: / -16 / SHA-256 /, / digest-bytes: / h'efe16b6a486ff25e9fb5fabf515e2bfc 3f38b405de377477b23275b53049b46b' ] >>, / parameter-image-size / 14: 31 }, / condition-image-match / 3, 15 ] >> } >> }) ]]>

In hex format, the SUIT manifest is this:

AES Key Wrap Example with Fetch + Copy Directives The following SUIT manifest requests a parser to fetch the encrypted payload and to stores it. Then, the payload is decrypt and stored into another component with the suit-directive-copy directive. This approach works well on constrained devices with execute-in-place flash memory. The SUIT manifest in diagnostic notation (with line breaks added for readability) is shown here:

>, << / COSE_Sign1_Tagged / 18([ / protected: / << { / algorithm-id / 1: -7 / ES256 / } >>, / unprotected: / {}, / payload: / null, / signature: / h'A8C807FF03015088492C9C3B0779A771 502639676E7D27C3D33E8432037FA9D1 FE948D3C4C82778A6E2B1ADA74287809 526014A2BACFDC64600F63847956AE6F' ]) >> ] >>, / manifest / 3: << { / manifest-version / 1: 1, / manifest-sequence-number / 2: 1, / common / 3: << { / components / 2: [ [h'00'] / to be decrypted payload /, [h'01'] / encrypted payload / ] } >>, / install / 17: << [ / fetch encrypted firmware / / directive-set-component-index / 12, 1 / [h'01'] /, / directive-override-parameters / 20, { / parameter-uri / 21: "https://author.example.com/encrypted-firmware.bin", / parameter-image-size / 14: 47 }, / directive-fetch / 21, 15, / decrypt encrypted firmware / / directive-set-component-index / 12, 0 / [h'00'] /, / directive-override-parameters / 20, { / parameter-source-component / 22: 1 / [h'01'] /, / parameter-encryption-info / 19: << 96([ / protected: / << { / alg / 1: 1 / AES-GCM-128 / } >>, / unprotected: / { / IV / 5: h'1de460e8b5b68d7222c0d6f20484d8ab' }, / payload: / null / detached ciphertext /, / recipients: / [ [ / protected: / << { } >>, / unprotected: / { / alg / 1: -3 / A128KW /, / kid / 4: 'kid-1' }, / payload: / h'a86200e4754733e4c00fc08c 6a72cc1996e129922eab504f' / CEK encrypted with KEK / ] ] ]) >> }, / directive-copy / 22, 15 / consumes the SUIT_Encryption_Info above /, / verify decrypted firmware / / directive-override-parameters / 20, { / parameter-image-digest / 3: << [ / digest-algorithm-id: / -16 / SHA-256 /, / digest-bytes: / h'efe16b6a486ff25e9fb5fabf515e2bfc 3f38b405de377477b23275b53049b46b' ] >>, / parameter-image-size / 14: 31 }, / condition-image-match / 3, 15 ] >> } >> }) ]]>

In hex format, the SUIT manifest is this:

Security Considerations The algorithms described in this document assume that the party performing payload encryption shares a key-encryption key (KEK) with the recipient (for use with the AES Key Wrap scheme), or is in possession of the public key of the recipient (for use with ECDH-ES). Both cases require some upfront communication interaction. This interaction is likely provided by an device management solution, as described in . To provide high security for AES Key Wrap it is important that the KEK is of high entropy, and that implementations protect the KEK from disclosure. Compromise of the KEK may result in the disclosure of all key data protected with that KEK. Since the CEK is randomly generated, it must be ensured that the guidelines for random number generation in are followed. In some cases third party companies analyse binaries for known security vulnerabilities. With encrypted payloads this type of analysis is prevented. Consequently, these third party companies either need to be given access to the plaintext binary before encryption or they need to become authorized recipients of the encrypted payloads. In either case, it is necessary to explicitly consider those third parties in the software supply chain when such a binary analysis is desired.

IANA Considerations IANA is asked to add two values to the SUIT_Parameters registry established by .

[Editor's Note: - TBD1: Proposed 19 ]

In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. Concise Binary Object Representation (CBOR) is a data format designed for small code size and small message size. There is a need to be able to define basic security services for this data format. This document defines the CBOR Object Signing and Encryption (COSE) protocol. This specification describes how to create and process signatures, message authentication codes, and encryption using CBOR for serialization. This specification additionally describes how to represent cryptographic keys using CBOR. This document, along with RFC 9053, obsoletes RFC 8152. Concise Binary Object Representation (CBOR) is a data format designed for small code size and small message size. There is a need to be able to define basic security services for this data format. This document defines a set of algorithms that can be used with the CBOR Object Signing and Encryption (COSE) protocol (RFC 9052). This document, along with RFC 9052, obsoletes RFC 8152. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. Arm Limited Arm Limited Fraunhofer SIT Inria Nordic Semiconductor This specification describes the format of a manifest. A manifest is a bundle of metadata about code/data obtained by a recipient (chiefly the firmware for an IoT device), where to find the that code/data, the devices to which it applies, and cryptographic information protecting the manifest. Software updates and Trusted Invocation both tend to use sequences of common operations, so the manifest encodes those sequences of operations, rather than declaring the metadata. Vigil Security, LLC Arm Limited The Concise Binary Object Representation (CBOR) data format is designed for small code size and small message size. CBOR Object Signing and Encryption (COSE) is specified in RFC 9052 to provide basic security services using the CBOR data format. This document specifies the conventions for using AES-CTR and AES-CBC as Content Encryption algorithms with COSE. SECOM CO., LTD. This specification defines a method for computing a hash value over a COSE Key. It defines which fields in a COSE Key structure are used in the hash computation, the method of creating a canonical form of the fields, and how to hash the byte sequence. The resulting hash value can be used for identifying or selecting a key that is the subject of the thumbprint. Arm Limited SECOM CO., LTD. This specification describes extensions to the SUIT Manifest format (as defined in [I-D.ietf-suit-manifest]) for use in deployments with multiple trust domains. A device has more than one trust domain when it enables delegation of different rights to mutually distrusting entities for use for different purposes or Components in the context of firmware or software update. Vulnerabilities in Internet of Things (IoT) devices have raised the need for a reliable and secure firmware update mechanism suitable for devices with resource constraints. Incorporating such an update mechanism is a fundamental requirement for fixing vulnerabilities, but it also enables other important capabilities such as updating configuration settings and adding new functionality. In addition to the definition of terminology and an architecture, this document provides the motivation for the standardization of a manifest format as a transport-agnostic means for describing and protecting firmware updates. Vulnerabilities with Internet of Things (IoT) devices have raised the need for a reliable and secure firmware update mechanism that is also suitable for constrained devices. Ensuring that devices function and remain secure over their service lifetime requires such an update mechanism to fix vulnerabilities, update configuration settings, and add new functionality. One component of such a firmware update is a concise and machine-processable metadata document, or manifest, that describes the firmware image(s) and offers appropriate protection. This document describes the information that must be present in the manifest. Randomness is a crucial ingredient for Transport Layer Security (TLS) and related security protocols. Weak or predictable "cryptographically secure" pseudorandom number generators (CSPRNGs) can be abused or exploited for malicious purposes. An initial entropy source that seeds a CSPRNG might be weak or broken as well, which can also lead to critical and systemic security problems. This document describes a way for security protocol implementations to augment their CSPRNGs using long-term private keys. This improves randomness from broken or otherwise subverted CSPRNGs. This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF. This document describes the Cryptographic Message Syntax (CMS). This syntax is used to digitally sign, digest, authenticate, or encrypt arbitrary message content. [STANDARDS-TRACK] This memo profiles the X.509 v3 certificate and X.509 v2 certificate revocation list (CRL) for use in the Internet. An overview of this approach and model is provided as an introduction. The X.509 v3 certificate format is described in detail, with additional information regarding the format and semantics of Internet name forms. Standard certificate extensions are described and two Internet-specific extensions are defined. A set of required certificate extensions is specified. The X.509 v2 CRL format is described in detail along with standard and Internet-specific extensions. An algorithm for X.509 certification path validation is described. An ASN.1 module and examples are provided in the appendices. [STANDARDS-TRACK] Internet Assigned Numbers Authority Wikipedia

Acknowledgements We would like to thank Henk Birkholz for his feedback on the CDDL description in this document. Additionally, we would like to thank Michael Richardson, Øyvind Rønningstad, Dave Thaler, Laurence Lundblade, and Carsten Bormann for their review feedback. Finally, we would like to thank Dick Brooks for making us aware of the challenges firmware encryption imposes on binary analysis.