draft-ietf-suit-firmware-encryption-00.txt   draft-ietf-suit-firmware-encryption-01.txt 
SUIT H. Tschofenig SUIT H. Tschofenig
Internet-Draft Arm Limited Internet-Draft Arm Limited
Intended status: Standards Track R. Housley Intended status: Standards Track R. Housley
Expires: January 8, 2022 Vigil Security Expires: January 13, 2022 Vigil Security
B. Moran B. Moran
Arm Limited Arm Limited
July 07, 2021 July 12, 2021
Firmware Encryption with SUIT Manifests Firmware Encryption with SUIT Manifests
draft-ietf-suit-firmware-encryption-00 draft-ietf-suit-firmware-encryption-01
Abstract Abstract
This document specifies a firmware update mechanism where the This document specifies a firmware update mechanism where the
firmware image is encrypted. This mechanism uses the IETF SUIT firmware image is encrypted. This mechanism uses the IETF SUIT
manifest with key establishment provided by the hybrid public-key manifest with key establishment provided by the hybrid public-key
encryption (HPKE) scheme or AES Key Wrap (AES-KW) with a pre-shared encryption (HPKE) scheme or AES Key Wrap (AES-KW) with a pre-shared
key-encryption key. In either case, AES-GCM or AES-CCM is used for key-encryption key. In either case, AES-GCM or AES-CCM is used for
firmware encryption. firmware encryption.
skipping to change at page 1, line 38 skipping to change at page 1, line 38
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/. Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on January 8, 2022. This Internet-Draft will expire on January 13, 2022.
Copyright Notice Copyright Notice
Copyright (c) 2021 IETF Trust and the persons identified as the Copyright (c) 2021 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(https://trustee.ietf.org/license-info) in effect on the date of (https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 2, line 25 skipping to change at page 2, line 25
the copyright in such materials, this document may not be modified the copyright in such materials, this document may not be modified
outside the IETF Standards Process, and derivative works of it may outside the IETF Standards Process, and derivative works of it may
not be created outside the IETF Standards Process, except to format not be created outside the IETF Standards Process, except to format
it for publication as an RFC or to translate it into languages other it for publication as an RFC or to translate it into languages other
than English. than English.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Conventions and Terminology . . . . . . . . . . . . . . . . . 3 2. Conventions and Terminology . . . . . . . . . . . . . . . . . 3
3. AES Key Wrap . . . . . . . . . . . . . . . . . . . . . . . . 4 3. Architecture . . . . . . . . . . . . . . . . . . . . . . . . 4
4. Hybrid Public-Key Encryption (HPKE) . . . . . . . . . . . . . 7 4. AES Key Wrap . . . . . . . . . . . . . . . . . . . . . . . . 5
5. Complete Examples . . . . . . . . . . . . . . . . . . . . . . 12 5. Hybrid Public-Key Encryption (HPKE) . . . . . . . . . . . . . 9
6. Security Considerations . . . . . . . . . . . . . . . . . . . 12 6. Complete Examples . . . . . . . . . . . . . . . . . . . . . . 14
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 13 7. Security Considerations . . . . . . . . . . . . . . . . . . . 15
8. References . . . . . . . . . . . . . . . . . . . . . . . . . 14 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 15
8.1. Normative References . . . . . . . . . . . . . . . . . . 14 9. References . . . . . . . . . . . . . . . . . . . . . . . . . 16
8.2. Informative References . . . . . . . . . . . . . . . . . 15 9.1. Normative References . . . . . . . . . . . . . . . . . . 16
Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 16 9.2. Informative References . . . . . . . . . . . . . . . . . 17
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 16 Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 18
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 18
1. Introduction 1. Introduction
Vulnerabilities with Internet of Things (IoT) devices have raised the Vulnerabilities with Internet of Things (IoT) devices have raised the
need for a reliable and secure firmware update mechanism that is also need for a reliable and secure firmware update mechanism that is also
suitable for constrained devices. To protect firmware images the suitable for constrained devices. To protect firmware images the
SUIT manifest format was developed [I-D.ietf-suit-manifest]. The SUIT manifest format was developed [I-D.ietf-suit-manifest]. The
SUIT manifest provides a bundle of metadata about the firmware for an SUIT manifest provides a bundle of metadata about the firmware for an
IoT device, where to find the firmware image, and the devices to IoT device, where to find the firmware image, and the devices to
which it applies. which it applies.
skipping to change at page 3, line 20 skipping to change at page 3, line 20
of the firmware image to decrypt it. of the firmware image to decrypt it.
A symmetric cryptographic key is established for encryption and A symmetric cryptographic key is established for encryption and
decryption, and that key can be applied to a SUIT manifest, firmware decryption, and that key can be applied to a SUIT manifest, firmware
images, or personalization data, depending on the encryption choices images, or personalization data, depending on the encryption choices
of the firmware author. This symmetric key can be established using of the firmware author. This symmetric key can be established using
a variety of mechanisms; this document defines two approaches for use a variety of mechanisms; this document defines two approaches for use
with the IETF SUIT manifest. Key establishment can be provided by with the IETF SUIT manifest. Key establishment can be provided by
the hybrid public-key encryption (HPKE) scheme or AES Key Wrap (AES- the hybrid public-key encryption (HPKE) scheme or AES Key Wrap (AES-
KW) with a pre-shared key-encryption key. These choices reduce the KW) with a pre-shared key-encryption key. These choices reduce the
number of possible key establishment options for interoperability of number of possible key establishment options and thereby help
different SUIT manifest implementations. The document also offers a increase interoperability between different SUIT manifest parser
number of examples for developers. implementations.
The document also contains a number of examples for developers.
2. Conventions and Terminology 2. Conventions and Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in "OPTIONAL" in this document are to be interpreted as described in
BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here. capitals, as shown here.
This document assumes familiarity with the IETF SUIT manifest This document assumes familiarity with the IETF SUIT manifest
[I-D.ietf-suit-manifest] and the SUIT architecture [RFC9019]. [I-D.ietf-suit-manifest] and the SUIT architecture [RFC9019].
The terms "recipient" and "firmware consumer" are used In context of encryption, the terms "recipient" and "firmware
interchangeably. consumer" are used interchangeably.
Additionally, the following abbreviations are used in this document: Additionally, the following abbreviations are used in this document:
- Key Wrap (KW), defined in RFC 3394 [RFC3394] for use with AES. - Key Wrap (KW), defined in RFC 3394 [RFC3394] for use with AES.
- Key-encryption key / key-encrypting key (KEK), a term defined in - Key-encryption key / key-encrypting key (KEK), a term defined in
RFC 4949 [RFC4949]. RFC 4949 [RFC4949].
- Content-encryption key (CEK), a term defined in RFC 2630 - Content-encryption key (CEK), a term defined in RFC 2630
[RFC2630]. [RFC2630].
- Hybrid Public Key Encryption (HPKE), defined in - Hybrid Public Key Encryption (HPKE), defined in
[I-D.irtf-cfrg-hpke]. [I-D.irtf-cfrg-hpke].
3. AES Key Wrap 3. Architecture
Figure 1 in [RFC9019] shows the architecture for distributing
firmware images and manifests from the author to the firmware
consumer. It does, however, not detail the use of encrypted firmware
images. Figure 1 therefore focuses on those aspects. The firmware
server and the device management infrastructure is represented by the
distribution system, which is aware of the individual devices a
firmware update has to be delivered to.
Firmware encryption requires the party doing the encryption to know
either the KEK (in case of AES-KW) or the public key of the recipient
(in case of HPKE). The firmware author may have knowledge about all
the devices but in most cases this will not be likely. Hence, it is
the responsibility of the distribution system to perform the firmware
encryption.
Since including the COSE_Encrypt structure in the manifest
invalidates a a digital signature or a MAC added by the author, this
structure needs to be added to the envelope by the distribution
system. This approach offers flexiblity when the number of devices
that need to receive encrypted firmware images changes dynamically or
when the updates to KEKs or recipient public keys are necessary. As
a downside, the author needs to trust the distribution system with
performing the encryption of the plaintext firmware image.
+----------+
| |
| Author |
| |
+----------+ +----------+
| | |
| Device |---+ | Firmware +
| | | | Manifest
+----------+ | |
| |
| +--------------+
+----------+ | | |
| | | Firmware + Manifest | Distribution |
| Device |---+------------------------| System |
| | | | |
+----------+ | +--------------+
|
|
+----------+ |
| | |
| Device +---+
| |
+----------+
Figure 1: Firmware Encryption Architecture.
4. AES Key Wrap
The AES Key Wrap (AES-KW) algorithm is described in RFC 3394 The AES Key Wrap (AES-KW) algorithm is described in RFC 3394
[RFC3394], and it can be used to encrypt a randomly generated [RFC3394], and it can be used to encrypt a randomly generated
content-encryption key (CEK) with a pre-shared key-encryption key content-encryption key (CEK) with a pre-shared key-encryption key
(KEK). The COSE conventions for using AES-KW are specified in (KEK). The COSE conventions for using AES-KW are specified in
Section 12.2.1 of [RFC8152]. The encrypted CEK is carried in the Section 12.2.1 of [RFC8152]. The encrypted CEK is carried in the
COSE_recipient structure alongside the information needed for AES-KW. COSE_recipient structure alongside the information needed for AES-KW.
The COSE_recipient structure, which is a substructure of the The COSE_recipient structure, which is a substructure of the
COSE_Encrypt, contains the CEK encrypted by the KEK. When the COSE_Encrypt structure, contains the CEK encrypted by the KEK.
firmware image is encrypted for use by multiple recipients, the
COSE_recipient structure will contain one encrypted CEK if all of the
authorized recipients have access to the KEK.
However, the COSE_recipient structure can contain the same CEK When the firmware image is encrypted for use by multiple recipients,
encrypted with many different KEKs if needed to reach all of the there are three options:
authorized recipients.
- If all of authorized recipients have access to the KEK, a single
COSE_recipient structure contains the encrypted CEK.
- If recipients have different KEKs, then the COSE_recipient
structure may contain the same CEK encrypted with many different
KEKs. The benefit of this approach is that the firmware image is
encrypted only once with the CEK while the authorized recipients
still need to use their individual KEKs to obtain the plaintext.
- The last option is to use different CEKs encrypted with KEKs of
the authorized recipients. This is appropriate when no benefits
can be gained from encrypting and transmitting firmware images
only once. For example, firmware images may contain information
unique to a device instance.
Note that the AES-KW algorithm, as defined in Section 2.2.3.1 of Note that the AES-KW algorithm, as defined in Section 2.2.3.1 of
[RFC3394], does not have public parameters that vary on a per- [RFC3394], does not have public parameters that vary on a per-
invocation basis. Hence, the protected structure in the invocation basis. Hence, the protected structure in the
COSE_recipient is a byte string of zero length. COSE_recipient is a byte string of zero length.
The COSE_Encrypt conveys information for encrypting the firmware The COSE_Encrypt conveys information for encrypting the firmware
image, which includes information like the algorithm and the IV, even image, which includes information like the algorithm and the IV, even
though the firmware image is not embedded in the though the firmware image is not embedded in the
COSE_Encrypt.ciphertext itself since it conveyed as detached content. COSE_Encrypt.ciphertext itself since it conveyed as detached content.
The CDDL for the COSE_Encrypt_Tagged structure is shown in Figure 1. The CDDL for the COSE_Encrypt_Tagged structure is shown in Figure 2.
COSE_Encrypt_Tagged = #6.96(COSE_Encrypt) COSE_Encrypt_Tagged = #6.96(COSE_Encrypt)
SUIT_Encryption_Info = COSE_Encrypt_Tagged SUIT_Encryption_Info = COSE_Encrypt_Tagged
COSE_Encrypt = [ COSE_Encrypt = [
protected : bstr .cbor outer_header_map_protected, protected : bstr .cbor outer_header_map_protected,
unprotected : outer_header_map_unprotected, unprotected : outer_header_map_unprotected,
ciphertext : null, ; because of detached ciphertext ciphertext : null, ; because of detached ciphertext
recipients : [ + COSE_recipient ] recipients : [ + COSE_recipient ]
skipping to change at page 5, line 41 skipping to change at page 7, line 41
ciphertext : bstr ; CEK encrypted with KEK ciphertext : bstr ; CEK encrypted with KEK
] ]
recipient_header_map = recipient_header_map =
{ {
1 => int, ; algorithm identifier 1 => int, ; algorithm identifier
4 => bstr, ; key identifier 4 => bstr, ; key identifier
* label =values ; extension point * label =values ; extension point
} }
Figure 1: CDDL for AES Key Wrap-based Firmware Encryption Figure 2: CDDL for AES Key Wrap-based Firmware Encryption
The COSE specification requires a consistent byte stream for the The COSE specification requires a consistent byte stream for the
authenticated data structure to be created, which is defined as shown authenticated data structure to be created, which is shown in
in Figure 2. Figure 3.
Enc_structure = [ Enc_structure = [
context : "Encrypt", context : "Encrypt",
protected : empty_or_serialized_map, protected : empty_or_serialized_map,
external_aad : bstr external_aad : bstr
] ]
Figure 2: CDDL for Enc_structure Data Structure Figure 3: CDDL for Enc_structure Data Structure
As it can be seen in the CDDL in Figure 1, there are two protected As shown in Figure 2, there are two protected fields: one protected
fields and the 'protected' field in the Enc_structure, see Figure 2, field in the COSE_Encrypt structure and a second one in the
refers to the outer protected field, not the protected field of the COSE_recipient structure. The 'protected' field in the
COSE_recipient structure. Enc_structure, see Figure 3, refers to the content of the protected
field from the COSE_Encrypt structure, not to the protected field of
the COSE_recipient structure.
The value of the external_aad is set to null. The value of the external_aad is set to null.
The following example illustrates the use of the AES-KW algorithm The following example illustrates the use of the AES-KW algorithm
with AES-128. with AES-128.
We use the following parameters in this example: We use the following parameters in this example:
- IV: 0x26, 0x68, 0x23, 0x06, 0xd4, 0xfb, 0x28, 0xca, 0x01, 0xb4, - IV: 0x26, 0x68, 0x23, 0x06, 0xd4, 0xfb, 0x28, 0xca, 0x01, 0xb4,
0x3b, 0x80 0x3b, 0x80
skipping to change at page 6, line 44 skipping to change at page 8, line 46
- Firmware (hex): - Firmware (hex):
546869732069732061207265616C206669726D7761726520696D6167652E 546869732069732061207265616C206669726D7761726520696D6167652E
The COSE_Encrypt structure in hex format is (with a line break The COSE_Encrypt structure in hex format is (with a line break
inserted): inserted):
D8608443A10101A1054C26682306D4FB28CA01B43B80F68340A2012204456B69642D D8608443A10101A1054C26682306D4FB28CA01B43B80F68340A2012204456B69642D
315818AF09622B4F40F17930129D18D0CEA46F159C49E7F68B644D 315818AF09622B4F40F17930129D18D0CEA46F159C49E7F68B644D
The resulting COSE_Encrypt structure in a dignostic format is shown The resulting COSE_Encrypt structure in a dignostic format is shown
in Figure 3. in Figure 4.
96( 96(
[ [
// protected field with alg=AES-GCM-128 // protected field with alg=AES-GCM-128
h'A10101', h'A10101',
{ {
// unprotected field with iv // unprotected field with iv
5: h'26682306D4FB28CA01B43B80' 5: h'26682306D4FB28CA01B43B80'
}, },
// null because of detached ciphertext // null because of detached ciphertext
skipping to change at page 7, line 27 skipping to change at page 9, line 27
{ // unprotected field { // unprotected field
1: -3, // alg=A128KW 1: -3, // alg=A128KW
4: h'6B69642D31' // key id 4: h'6B69642D31' // key id
}, },
// CEK encrypted with KEK // CEK encrypted with KEK
h'AF09622B4F40F17930129D18D0CEA46F159C49E7F68B644D' h'AF09622B4F40F17930129D18D0CEA46F159C49E7F68B644D'
] ]
] ]
) )
Figure 3: COSE_Encrypt Example for AES Key Wrap Figure 4: COSE_Encrypt Example for AES Key Wrap
The CEK was "4C805F1587D624ED5E0DBB7A7F7FA7EB" and the encrypted The CEK was "4C805F1587D624ED5E0DBB7A7F7FA7EB" and the encrypted
firmware was: firmware was:
A8B6E61EF17FBAD1F1BF3235B3C64C06098EA512223260 A8B6E61EF17FBAD1F1BF3235B3C64C06098EA512223260
F9425105F67F0FB6C92248AE289A025258F06C2AD70415 F9425105F67F0FB6C92248AE289A025258F06C2AD70415
4. Hybrid Public-Key Encryption (HPKE) 5. Hybrid Public-Key Encryption (HPKE)
Hybrid public-key encryption (HPKE) [I-D.irtf-cfrg-hpke] is a scheme Hybrid public-key encryption (HPKE) [I-D.irtf-cfrg-hpke] is a scheme
that provides public key encryption of arbitrary-sized plaintexts that provides public key encryption of arbitrary-sized plaintexts
given a recipient's public key. given a recipient's public key.
For use with firmware encryption the scheme works as follows: The For use with firmware encryption the scheme works as follows: The
firmware author uses HPKE, which internally utilizes a non- firmware author uses HPKE, which internally utilizes a non-
interactive ephemeral-static Diffie-Hellman exchange to derive a interactive ephemeral-static Diffie-Hellman exchange to derive a
shared secret, which is then used to encrypt plaintext. In the shared secret, which is then used to encrypt plaintext.
firmware encryption scenario, the plaintext passed to HPKE for
encryption is a randomly generated CEK. The output of the HPKE In the firmware encryption scenario, the plaintext passed to HPKE for
encryption is the randomly generated CEK. The output of the HPKE
operation is therefore the encrypted CEK along with HPKE encapsulated operation is therefore the encrypted CEK along with HPKE encapsulated
key (i.e. the ephemeral ECDH public key of the author). The CEK is key (i.e. the ephemeral ECDH public key of the author). The CEK is
then used to encrypt the firmware. then used to encrypt the firmware.
Only the holder of recipient's private key can decapsulate the CEK to Only the holder of recipient's private key can decapsulate the CEK to
decrypt the firmware. Key generation is influced by additional decrypt the firmware. Key generation is influced by additional
parameters, such as identity information. parameters, such as identity information.
This approach allows us to have all recipients to use the same CEK to This approach allows all recipients to use the same CEK to encrypt
encrypt the firmware image, in case there are multiple recipients, to the firmware image, in case there are multiple recipients, to fulfill
fulfill a requirement for the efficient distribution of firmware a requirement for the efficient distribution of firmware images using
images using a multicast or broadcast protocol. a multicast or broadcast protocol.
The CDDL for the COSE_Encrypt structure as used with HPKE is shown in The CDDL for the COSE_Encrypt structure as used with HPKE is shown in
Figure 4. Figure 5.
COSE_Encrypt_Tagged = #6.96(COSE_Encrypt) COSE_Encrypt_Tagged = #6.96(COSE_Encrypt)
SUIT_Encryption_Info = COSE_Encrypt_Tagged SUIT_Encryption_Info = COSE_Encrypt_Tagged
COSE_Encrypt = [ COSE_Encrypt = [
protected : bstr .cbor header_map, ; must contain alg protected : bstr .cbor header_map, ; must contain alg
unprotected : header_map, ; must contain iv unprotected : header_map, ; must contain iv
ciphertext : null, ; because of detached ciphertext ciphertext : null, ; because of detached ciphertext
recipients : [ + COSE_recipient_outer ] recipients : [ + COSE_recipient_outer ]
skipping to change at page 9, line 42 skipping to change at page 11, line 42
* label =values, * label =values,
} }
Generic_Headers = ( Generic_Headers = (
? 1 => int, ; algorithm identifier ? 1 => int, ; algorithm identifier
? 2 => crv, ; EC identifier ? 2 => crv, ; EC identifier
? 4 => bstr, ; key identifier ? 4 => bstr, ; key identifier
? 5 => bstr ; IV ? 5 => bstr ; IV
) )
Figure 4: CDDL for HPKE-based COSE_Encrypt Structure Figure 5: CDDL for HPKE-based COSE_Encrypt Structure
The COSE_Encrypt structure in Figure 4 requires the encrypted CEK and The COSE_Encrypt structure in Figure 5 requires the encrypted CEK and
the ephemeral public key of the firmare author to be generated. This the ephemeral public key of the firmare author to be generated. This
is accomplished with the HPKE encryption function as shown in is accomplished with the HPKE encryption function as shown in
Figure 5. Figure 6.
CEK = random() CEK = random()
pkR = DeserializePublicKey(recipient_public_key) pkR = DeserializePublicKey(recipient_public_key)
info = "cose hpke" || 0x00 || COSE_KDF_Context info = "cose hpke" || 0x00 || COSE_KDF_Context
enc, context = SetupBaseS(pkR, info) enc, context = SetupBaseS(pkR, info)
ciphertext = context.Seal(null, CEK) ciphertext = context.Seal(null, CEK)
Figure 5 Figure 6
Legend: Legend:
- The functions DeserializePublicKey(), SetupBaseS() and Seal() are - The functions DeserializePublicKey(), SetupBaseS() and Seal() are
defined in HPKE [I-D.irtf-cfrg-hpke]. defined in HPKE [I-D.irtf-cfrg-hpke].
- CEK is a random byte sequence of keysize length whereby keysize - CEK is a random byte sequence of keysize length whereby keysize
corresponds to the size of the indicated symmetric encryption corresponds to the size of the indicated symmetric encryption
algorithm used for firmware encryption. For example, AES-128-GCM algorithm used for firmware encryption. For example, AES-128-GCM
requires a 16 byte key. The CEK would therefore be 16 bytes long. requires a 16 byte key. The CEK would therefore be 16 bytes long.
- 'recipient_public_key' represents the public key of the recipient. - 'recipient_public_key' represents the public key of the recipient.
- 'info' is a data structure described below used as input to the - 'info' is a data structure described below used as input to the
key derivation internal to the HPKE algorithm. In addition to the key derivation internal to the HPKE algorithm. In addition to the
constant prefix, the COSE_KDF_Context structure is used. The constant prefix, the COSE_KDF_Context structure is used. The
COSE_KDF_Context is shown in Figure 6. COSE_KDF_Context is shown in Figure 7.
The result of the above-described operation is the encrypted CEK The result of the above-described operation is the encrypted CEK
(denoted as ciphertext) and the enc - the HPKE encapsulated key (i.e. (denoted as ciphertext) and the enc - the HPKE encapsulated key (i.e.
the ephemeral ECDH public key of the author). the ephemeral ECDH public key of the author).
PartyInfo = ( PartyInfo = (
identity : bstr, identity : bstr,
nonce : nil, nonce : nil,
other : nil other : nil
) )
skipping to change at page 10, line 50 skipping to change at page 12, line 50
COSE_KDF_Context = [ COSE_KDF_Context = [
AlgorithmID : int, AlgorithmID : int,
PartyUInfo : [ PartyInfo ], PartyUInfo : [ PartyInfo ],
PartyVInfo : [ PartyInfo ], PartyVInfo : [ PartyInfo ],
SuppPubInfo : [ SuppPubInfo : [
keyDataLength : uint, keyDataLength : uint,
protected : empty_or_serialized_map protected : empty_or_serialized_map
], ],
] ]
Figure 6: COSE_KDF_Context Data Structure Figure 7: COSE_KDF_Context Data Structure
Notes: Notes:
- PartyUInfo.identity corresponds to the kid found in the - PartyUInfo.identity corresponds to the kid found in the
COSE_Sign_Tagged or COSE_Sign1_Tagged structure (when a digital COSE_Sign_Tagged or COSE_Sign1_Tagged structure (when a digital
signature is used. When utilizing a MAC, then the kid is found in signature is used). When utilizing a MAC, then the kid is found
the COSE_Mac_Tagged or COSE_Mac0_Tagged structure. in the COSE_Mac_Tagged or COSE_Mac0_Tagged structure.
- PartyVInfo.identity corresponds to the kid used for the respective - PartyVInfo.identity corresponds to the kid used for the respective
recipient from the inner-most recipients array. recipient from the inner-most recipients array.
- The value in the AlgorithmID field corresponds to the alg - The value in the AlgorithmID field corresponds to the alg
parameter in the protected structure in the inner-most recipients parameter in the protected structure in the inner-most recipients
array. array.
- keyDataLength is set to the number of bits of the desired output - keyDataLength is set to the number of bits of the desired output
value. value.
- protected refers to the protected structure of the inner-most - protected refers to the protected structure of the inner-most
array. array.
The author encrypts the firmware using the CEK with the selected The author encrypts the firmware using the CEK with the selected
algorithm. algorithm.
The recipient decrypts the received ciphertext, i.e. the encrypted The recipient decrypts the encrypted CEK, using two input parameters:
CEK, using two input parameters:
- the private key skR corresponding to the public key pkR used by - the private key skR corresponding to the public key pkR used by
the author when creating the manifest. the author when creating the manifest.
- the HPKE encapsulated key (i.e. ephemeral ECDH public key) created - the HPKE encapsulated key (i.e. ephemeral ECDH public key) created
by the author. by the author.
If the HPKE operation is successful, the recipient obtains the CEK If the HPKE operation is successful, the recipient obtains the CEK
and can decrypt the firmware. and can decrypt the firmware.
Figure 7 shows the HPKE computations performed by the recipient for Figure 8 shows the HPKE computations performed by the recipient for
decryption. decryption.
info = "cose hpke" || 0x00 || COSE_KDF_Context info = "cose hpke" || 0x00 || COSE_KDF_Context
context = SetupBaseR(ciphertext, skR, info) context = SetupBaseR(ciphertext, skR, info)
CEK = context.Open(null, ciphertext) CEK = context.Open(null, ciphertext)
Figure 7 Figure 8
An example of the COSE_Encrypt structure using the HPKE scheme is An example of the COSE_Encrypt structure using the HPKE scheme is
shown in Figure 8. shown in Figure 9. It uses the following algorithm combination:
- AES-GCM-128 for encryption of the firmware image.
- AES-GCM-128 for encrytion of the CEK.
- Key Encapsulation Mechanism (KEM): NIST P-256
- Key Derivation Function (KDF): HKDF-SHA256
96( 96(
[ [
// protected field with alg=AES-GCM-128 // protected field with alg=AES-GCM-128
h'A10101', h'A10101',
{ // unprotected field with iv { // unprotected field with iv
5: h'26682306D4FB28CA01B43B80' 5: h'26682306D4FB28CA01B43B80'
}, },
// null because of detached ciphertext // null because of detached ciphertext
null, null,
skipping to change at page 12, line 37 skipping to change at page 14, line 41
// kid for recipient static ECDH public key // kid for recipient static ECDH public key
4: h'6B69642D31' 4: h'6B69642D31'
}, },
// empty ciphertext // empty ciphertext
null null
] ]
] ]
] ]
) )
Figure 8: COSE_Encrypt Example for HPKE Figure 9: COSE_Encrypt Example for HPKE
5. Complete Examples 6. Complete Examples
TBD: Add example for complete manifest here (which also includes the TBD: Example for complete manifest here (which also includes the
digital signature). TBD: Add multiple recipient example as well. digital signature). TBD: Multiple recipient example as well. TBD:
TBD: Add encryption of manifest (in addition of firmware encryption). Encryption of manifest (in addition of firmware encryption).
6. Security Considerations 7. Security Considerations
The algorithms described in this document assume that the firmware The algorithms described in this document assume that the firmware
author author
- has either shared a key-encryption key (KEK) with the firmware - has either shared a key-encryption key (KEK) with the firmware
consumer (for use with the AES-Key Wrap scheme), or consumer (for use with the AES-Key Wrap scheme), or
- is in possession of the public key of the firmware consumer (for - is in possession of the public key of the firmware consumer (for
use with HPKE). use with HPKE).
Both cases require some upfront communication interaction, which is Both cases require some upfront communication interaction, which is
not part of the SUIT manifest. This interaction is likely provided not part of the SUIT manifest. This interaction is likely provided
by a IoT device management solution, as described in [RFC9019]. by an IoT device management solution, as described in [RFC9019].
For AES-Key Wrap to provide high security it is important that the For AES-Key Wrap to provide high security it is important that the
KEK is of high entropy, and that implementations protect the KEK from KEK is of high entropy, and that implementations protect the KEK from
disclosure. Compromise of the KEK may result in the disclosure of disclosure. Compromise of the KEK may result in the disclosure of
all key data protected with that KEK. all key data protected with that KEK.
Since the CEK is randomly generated, it must be ensured that the Since the CEK is randomly generated, it must be ensured that the
guidelines for random number generations are followed, see [RFC8937]. guidelines for random number generations are followed, see [RFC8937].
7. IANA Considerations In some cases third party companies analyse binaries for known
security vulnerabilities. With encrypted firmware images this type
of analysis is prevented. Consequently, these third party companies
either need to be given access to the plaintext binary before
encryption or they need to become authorized recipients of the
encrypted firmware images. In either case, it is necessary to
explicitly consider those third parties in the software supply chain
when such a binary analysis is desired.
8. IANA Considerations
This document requests IANA to create new entries in the COSE This document requests IANA to create new entries in the COSE
Algorithms registry established with [I-D.ietf-cose-rfc8152bis-algs]. Algorithms registry established with [I-D.ietf-cose-rfc8152bis-algs].
+-------------+-------+---------+------------+--------+---------------+ +-------------+-------+---------+------------+--------+---------------+
| Name | Value | KDF | Ephemeral- | Key | Description | | Name | Value | KDF | Ephemeral- | Key | Description |
| | | | Static | Wrap | | | | | | Static | Wrap | |
+-------------+-------+---------+------------+--------+---------------+ +-------------+-------+---------+------------+--------+---------------+
| HPKE/P-256+ | TBD1 | HKDF - | yes | none | HPKE with | | HPKE/P-256+ | TBD1 | HKDF - | yes | none | HPKE with |
| HKDF-256 | | SHA-256 | | | ECDH-ES | | HKDF-256 | | SHA-256 | | | ECDH-ES |
skipping to change at page 14, line 35 skipping to change at page 16, line 35
| X25519 + | | SHA-256 | | | ECDH-ES | | X25519 + | | SHA-256 | | | ECDH-ES |
| HKDF-SHA256 | | | | | (X25519) + | | HKDF-SHA256 | | | | | (X25519) + |
| | | | | | HKDF-256 | | | | | | | HKDF-256 |
+-------------+-------+---------+------------+--------+---------------+ +-------------+-------+---------+------------+--------+---------------+
| HPKE | TBD4 | HKDF - | yes | none | HPKE with | | HPKE | TBD4 | HKDF - | yes | none | HPKE with |
| X448 + | | SHA-512 | | | ECDH-ES | | X448 + | | SHA-512 | | | ECDH-ES |
| HKDF-SHA512 | | | | | (X448) + | | HKDF-SHA512 | | | | | (X448) + |
| | | | | | HKDF-512 | | | | | | | HKDF-512 |
+-------------+-------+---------+------------+--------+---------------+ +-------------+-------+---------+------------+--------+---------------+
8. References 9. References
8.1. Normative References 9.1. Normative References
[I-D.ietf-cose-rfc8152bis-algs] [I-D.ietf-cose-rfc8152bis-algs]
August Cellars, "CBOR Object Signing and Encryption Schaad, J., "CBOR Object Signing and Encryption (COSE):
(COSE): Initial Algorithms", draft-ietf-cose-rfc8152bis- Initial Algorithms", draft-ietf-cose-rfc8152bis-algs-12
algs-12 (work in progress), September 2020. (work in progress), September 2020.
[I-D.ietf-suit-manifest] [I-D.ietf-suit-manifest]
Arm Limited, Arm Limited, Fraunhofer SIT, and Inria, "A Moran, B., Tschofenig, H., Birkholz, H., and K. Zandberg,
Concise Binary Object Representation (CBOR)-based "A Concise Binary Object Representation (CBOR)-based
Serialization Format for the Software Updates for Internet Serialization Format for the Software Updates for Internet
of Things (SUIT) Manifest", draft-ietf-suit-manifest-12 of Things (SUIT) Manifest", draft-ietf-suit-manifest-12
(work in progress), February 2021. (work in progress), February 2021.
[I-D.irtf-cfrg-hpke] [I-D.irtf-cfrg-hpke]
Cisco, Inria, Inria, and Cloudflare, "Hybrid Public Key Barnes, R. L., Bhargavan, K., Lipp, B., and C. A. Wood,
Encryption", draft-irtf-cfrg-hpke-08 (work in progress), "Hybrid Public Key Encryption", draft-irtf-cfrg-hpke-08
February 2021. (work in progress), February 2021.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997, DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>. <https://www.rfc-editor.org/info/rfc2119>.
[RFC3394] Schaad, J. and R. Housley, "Advanced Encryption Standard [RFC3394] Schaad, J. and R. Housley, "Advanced Encryption Standard
(AES) Key Wrap Algorithm", RFC 3394, DOI 10.17487/RFC3394, (AES) Key Wrap Algorithm", RFC 3394, DOI 10.17487/RFC3394,
September 2002, <https://www.rfc-editor.org/info/rfc3394>. September 2002, <https://www.rfc-editor.org/info/rfc3394>.
[RFC8152] Schaad, J., "CBOR Object Signing and Encryption (COSE)", [RFC8152] Schaad, J., "CBOR Object Signing and Encryption (COSE)",
RFC 8152, DOI 10.17487/RFC8152, July 2017, RFC 8152, DOI 10.17487/RFC8152, July 2017,
<https://www.rfc-editor.org/info/rfc8152>. <https://www.rfc-editor.org/info/rfc8152>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>. May 2017, <https://www.rfc-editor.org/info/rfc8174>.
8.2. Informative References 9.2. Informative References
[I-D.ietf-suit-information-model] [I-D.ietf-suit-information-model]
Arm Limited, Arm Limited, and Fraunhofer SIT, "A Manifest Moran, B., Tschofenig, H., and H. Birkholz, "A Manifest
Information Model for Firmware Updates in IoT Devices", Information Model for Firmware Updates in IoT Devices",
draft-ietf-suit-information-model-11 (work in progress), draft-ietf-suit-information-model-11 (work in progress),
April 2021. April 2021.
[RFC2630] Housley, R., "Cryptographic Message Syntax", RFC 2630, [RFC2630] Housley, R., "Cryptographic Message Syntax", RFC 2630,
DOI 10.17487/RFC2630, June 1999, DOI 10.17487/RFC2630, June 1999,
<https://www.rfc-editor.org/info/rfc2630>. <https://www.rfc-editor.org/info/rfc2630>.
[RFC4949] Shirey, R., "Internet Security Glossary, Version 2", [RFC4949] Shirey, R., "Internet Security Glossary, Version 2",
FYI 36, RFC 4949, DOI 10.17487/RFC4949, August 2007, FYI 36, RFC 4949, DOI 10.17487/RFC4949, August 2007,
skipping to change at page 16, line 10 skipping to change at page 18, line 10
[RFC9019] Moran, B., Tschofenig, H., Brown, D., and M. Meriac, "A [RFC9019] Moran, B., Tschofenig, H., Brown, D., and M. Meriac, "A
Firmware Update Architecture for Internet of Things", Firmware Update Architecture for Internet of Things",
RFC 9019, DOI 10.17487/RFC9019, April 2021, RFC 9019, DOI 10.17487/RFC9019, April 2021,
<https://www.rfc-editor.org/info/rfc9019>. <https://www.rfc-editor.org/info/rfc9019>.
Appendix A. Acknowledgements Appendix A. Acknowledgements
We would like to thank Henk Birkholz for his feedback on the CDDL We would like to thank Henk Birkholz for his feedback on the CDDL
description in this document. Additionally, we would like to thank description in this document. Additionally, we would like to thank
Michael Richardson and Carsten Bormann for their review feedback. Michael Richardson and Carsten Bormann for their review feedback.
Finally, we would like to thank Dick Brooks for making us aware of
the challenges firmware encryption imposes on binary analysis.
Authors' Addresses Authors' Addresses
Hannes Tschofenig Hannes Tschofenig
Arm Limited Arm Limited
EMail: hannes.tschofenig@arm.com EMail: hannes.tschofenig@arm.com
Russ Housley Russ Housley
Vigil Security, LLC Vigil Security, LLC
 End of changes. 46 change blocks. 
80 lines changed or deleted 167 lines changed or added

This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/