SUIT                                                       H. Tschofenig
Internet-Draft                                               Arm Limited
Intended status: Standards Track                              R. Housley
Expires: January 13, April 28, 2022                                   Vigil Security
                                                                B. Moran
                                                             Arm Limited
                                                           July 12,
                                                        October 25, 2021

                Firmware Encryption with SUIT Manifests
                 draft-ietf-suit-firmware-encryption-01
                 draft-ietf-suit-firmware-encryption-02

Abstract

   This document specifies a firmware update mechanism where the
   firmware image is encrypted.  This mechanism  Firmware encryption uses the IETF SUIT
   manifest with key establishment provided by the hybrid public-key
   encryption (HPKE) scheme or and the AES Key Wrap (AES-KW) with a pre-shared pre-
   shared key-encryption key.  In either case,  Encryption of the firmware image is
   encrypted using AES-GCM or AES-CCM is used for
   firmware encryption. AES-CCM.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on January 13, April 28, 2022.

Copyright Notice

   Copyright (c) 2021 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

   This document may contain material from IETF Documents or IETF
   Contributions published or made publicly available before November
   10, 2008.  The person(s) controlling the copyright in some of this
   material may not have granted the IETF Trust the right to allow
   modifications of such material outside the IETF Standards Process.
   Without obtaining an adequate license from the person(s) controlling
   the copyright in such materials, this document may not be modified
   outside the IETF Standards Process, and derivative works of it may
   not be created outside the IETF Standards Process, except to format
   it for publication as an RFC or to translate it into languages other
   than English.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Conventions and Terminology . . . . . . . . . . . . . . . . .   3
   3.  Architecture  . . . . . . . . . . . . . . . . . . . . . . . .   4
   4.  SUIT Envelope and SUIT Manifest . . . . . . . . . . . . . . .   6
   5.  AES Key Wrap  . . . . . . . . . . . . . . . . . . . . . . . .   5
   5.   7
   6.  Hybrid Public-Key Encryption (HPKE) . . . . . . . . . . . . .   9
   6.  11
   7.  CEK Verification  . . . . . . . . . . . . . . . . . . . . . .  15
   8.  Complete Examples . . . . . . . . . . . . . . . . . . . . . .  14
   7.  15
   9.  Security Considerations . . . . . . . . . . . . . . . . . . .  15
   8.  16
   10. IANA Considerations . . . . . . . . . . . . . . . . . . . . .  15
   9.  16
   11. References  . . . . . . . . . . . . . . . . . . . . . . . . .  16
     9.1.
     11.1.  Normative References . . . . . . . . . . . . . . . . . .  16
     9.2.
     11.2.  Informative References . . . . . . . . . . . . . . . . .  17
   Appendix A.  Acknowledgements . . . . . . . . . . . . . . . . . .  18  19
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  18  19

1.  Introduction

   Vulnerabilities with Internet of Things (IoT) devices have raised the
   need for a reliable and secure firmware update mechanism that is also
   suitable for constrained devices.  To protect firmware images the
   SUIT manifest format was developed [I-D.ietf-suit-manifest].  The
   SUIT manifest provides a bundle of metadata about the firmware for an
   IoT device, where to find the firmware image, and the devices to
   which it applies.

   The SUIT information model [I-D.ietf-suit-information-model] details
   the information that has to be offered by the SUIT manifest format.
   In addition to offering protection against modification, which is
   provided by a digital signature or a message authentication code, the
   firmware image may also be afforded confidentiality using encryption.

   Encryption prevents third parties, including attackers, from gaining
   access to the firmware image. binary.  Hackers typically need intimate
   knowledge of the target firmware to mount their attacks.  For
   example, return-oriented programming (ROP) requires intimate knowledge of access to the target firmware
   binary and encryption makes this approach it much more difficult to exploit. write exploits.

   The SUIT manifest provides the data needed for authorized recipients
   of the firmware image to decrypt it.

   A  The firmware image is encrypted
   using a symmetric key.  This symmetric cryptographic key is
   established for encryption and decryption, and that key can be
   applied to a SUIT manifest, firmware images, or personalization data,
   depending on the encryption choices of the firmware author.  This

   A symmetric key can be established using a variety of mechanisms;
   this document defines two approaches for use with the IETF SUIT manifest.  Key establishment can be provided by
   the
   manifest, namely:

   -  hybrid public-key encryption (HPKE) scheme or (HPKE), and

   -  AES Key Wrap (AES-
   KW) with (AES-KW) using a pre-shared key-encryption key. key (KEK).

   These choices reduce the number of possible key establishment options
   and thereby help increase interoperability between different SUIT
   manifest parser implementations.

   The document also contains a number of examples for developers. examples.

2.  Conventions and Terminology

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in
   BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
   capitals, as shown here.

   This document assumes familiarity with the IETF SUIT manifest
   [I-D.ietf-suit-manifest]
   [I-D.ietf-suit-manifest], the SUIT information model
   [I-D.ietf-suit-information-model] and the SUIT architecture
   [RFC9019].

   In context of encryption, the

   The terms "recipient" sender and "firmware
   consumer" recipient are used interchangeably. defined in [I-D.irtf-cfrg-hpke]
   and have the following meaning:

   -  Sender: Role of entity which sends an encrypted message.

   -  Recipient: Role of entity which receives an encrypted message.

   Additionally, the following abbreviations are used in this document:

   -  Key Wrap (KW), defined in RFC 3394 [RFC3394] for use with AES.

   -  Key-encryption key / key-encrypting key (KEK), a term defined in RFC 4949 [RFC4949].

   -  Content-encryption key (CEK), a term defined in RFC 2630
      [RFC2630].

   -  Hybrid Public Key Encryption (HPKE), defined in
      [I-D.irtf-cfrg-hpke].

3.  Architecture

   Figure 1 in

   [RFC9019] shows describes the architecture for distributing firmware images
   and manifests from the author to the firmware consumer.  It does,
   however, not detail the use of encrypted firmware images.

   This document enhances the SUIT architecutre to include firmware
   encryption.  Figure 1 therefore focuses on those aspects.  The shows the distribution system, which represents
   the firmware server and the device management infrastructure is represented by the infrastructure.  The
   distribution system, which system is aware of the individual devices to which a
   firmware update has to be delivered to. delivered.

                                              +----------+
                                              |          |
                                              |  Author  |
                                              |          |
    +----------+                              +----------+
    |  Device  |---+                               |
    |(Firmware |   |                               | Firmware +
    | Consumer)|   |                               | Manifest
    +----------+   |                               |
                   |                               |
                   |                        +--------------+
                   |                        |              |
    +----------+   |  Firmware + Manifest   | Distribution |
    |  Device  |---+------------------------|    System    |
    |(Firmware |   |                        |              |
    | Consumer)|   |                        |              |
    +----------+   |                        +--------------+
                   |
                   |
    +----------+   |
    |  Device  +---+
    |(Firmware |
    | Consumer)|
    +----------+

                Figure 1: Firmware Encryption Architecture.

   Firmware encryption requires the party doing the encryption sender to know
   either the firmware
   consumers and the respective credentials used by the key distribution
   mechanism.  For AES-KW the KEK (in needs to be known and, in case of AES-KW) or
   HPKE, the sender needs to be in possession of the public key of the recipient
   (in case of HPKE).
   recipient.

   The firmware author may have knowledge about all
   the devices that need to
   receive an encrypted firmware image but in most cases this will not
   be likely.  Hence, it  The distribution system certainly has the knowledge about
   the recipients to perform firmware encryption.

   To offer confidentiality protection for firmware images two
   deployment variants need to be supported:

   -  The firmware author acts as the sender and the recipient is the responsibility of
      firmware consumer (or the firmware consumers).

   -  The firmware author encrypts the firmware image with the
      distribution system to perform as the initial recipient.  Then, the
      distribution system decrypts and re-encrypts the firmware
   encryption.

   Since including image
      towards the COSE_Encrypt structure in firmware consumer(s).  Delegating the manifest
   invalidates a a digital signature or a MAC added by task of re-
      encrypting the author, this
   structure needs to be added firmware image to the envelope by the distribution
   system.  This approach system offers
      flexiblity when the number of devices that need to receive
      encrypted firmware images changes dynamically or when the updates to
      KEKs or recipient public keys are necessary.  As a downside, the
      author needs to trust the distribution system with performing the encryption
      re-encryption of the plaintext firmware image.

                                              +----------+
                                              |          |
                                              |  Author  |
                                              |          |
    +----------+                              +----------+
    |          |                                   |
    |  Device  |---+                               | Firmware +
    |          |   |                               | Manifest
    +----------+   |                               |
                   |                               |
                   |                        +--------------+
    +----------+   |                        |              |
    |          |   |  Firmware +

   Irrespectively of the two variants, the key distribution data (in
   form of the COSE_Encrypt structure) is included in the SUIT envelope
   rather than in the SUIT manifest since the manifest will be digitally
   signed (or MACed) by the firmware author.

   Since the SUIT envelope is not protected cryptographically an
   adversary could modify the COSE_Encrypt structure.  For example, if
   the attacker alters the key distribution data then a recipient will
   decrypt the firmware image with an incorrect key.  This will lead to
   expending energy and flash cycles until the failure is detected.  To
   mitigate this attack, the optional suit-cek-verification parameter is
   added to the manifest.  Since the manifest is protected by a digital
   signature (or a MAC), an adversary cannot successfully modify this
   value.  This parameter allows the recipient to verify whether the CEK
   has successfully been derived.

   Details about the changes to the envelope and the manifest can be
   found in the next section.

4.  SUIT Envelope and SUIT Manifest   | Distribution |
    |  Device  |---+------------------------|    System    |
    |          |   |                        |              |
    +----------+   |                        +--------------+
                   |
                   |
    +----------+   |
    |          |   |
    |  Device  +---+
    |          |
    +----------+

   This specification introduces two extensions to the SUIT envelope and
   the manifest structure, as motivated in Section 3.

   The SUIT envelope is enhanced with a key exchange payload, which is
   carried inside the suit-protection-wrappers parameter, see Figure 1: Firmware Encryption Architecture.

4. 2.
   One or multiple SUIT_Encryption_Info payload(s) are carried within
   the suit-protection-wrappers parameter.  The content of the
   SUIT_Encryption_Info payload is explained in Section 5 (for AES-KW)
   and in Section 6 (for HPKE).  When the encryption capability is used,
   the suit-protection-wrappers parameter MUST be included in the
   envelope.

   SUIT_Envelope_Tagged = #6.107(SUIT_Envelope)
   SUIT_Envelope = {
     suit-authentication-wrapper => bstr .cbor SUIT_Authentication,
     suit-manifest  => bstr .cbor SUIT_Manifest,
     SUIT_Severable_Manifest_Members,
     suit-protection-wrappers => bstr .cbor {
         *(int/str) => [+ SUIT_Encryption_Info]
     }
     * SUIT_Integrated_Payload,
     * SUIT_Integrated_Dependency,
     * $$SUIT_Envelope_Extensions,
     * (int => bstr)
   }

                       Figure 2: SUIT Envelope CDDL.

   The manifest is extended with a CEK verification parameter (called
   suit-cek-verification), see Figure 3.  This parameter is optional and
   is utilized in environments where battery exhaustion attacks are a
   concern.  Details about the CEK verification can be found in
   Section 7.

   SUIT_Manifest = {
       suit-manifest-version         => 1,
       suit-manifest-sequence-number => uint,
       suit-common                   => bstr .cbor SUIT_Common,
       ? suit-reference-uri          => tstr,
       ? suit-cek-verification       => bstr,
       SUIT_Severable_Members_Choice,
       SUIT_Unseverable_Members,
       * $$SUIT_Manifest_Extensions,
   }

                       Figure 3: SUIT Manifest CDDL.

5.  AES Key Wrap

   The AES Key Wrap (AES-KW) algorithm is described in RFC 3394
   [RFC3394], and it can be used to encrypt a randomly generated
   content-encryption key (CEK) with a pre-shared key-encryption key
   (KEK).  The COSE conventions for using AES-KW are specified in
   Section 12.2.1 of [RFC8152].  The encrypted CEK is carried in the
   COSE_recipient structure alongside the information needed for AES-KW.
   The COSE_recipient structure, which is a substructure of the
   COSE_Encrypt structure, contains the CEK encrypted by the KEK.

   When the firmware image is encrypted for use by multiple recipients,
   there are three options:

   - options.  We use the following notation KEK(R1,S) is
   the KEK shared between recipient R1 and the sender S.  Likewise,
   CEK(R1,S) is shared between R1 and S.  If a single CEK or a single
   KEK is shared with all authorized recipients R by a given sender S in
   a certain context then we use CEK(_,S) or KEK(_,S), respectively.
   The notation ENC(plaintext, key) refers to the encryption of
   plaintext with a given key.

   -  If all authorized recipients have access to the KEK, a single
      COSE_recipient structure contains the encrypted CEK.  This means
      KEK(*,S) ENC(CEK,KEK), and ENC(firmware,CEK).

   -  If recipients have different KEKs, then the multiple COSE_recipient
      structures are included but only a single CEK is used.  Each
      COSE_recipient structure may contain contains the same CEK encrypted with many different
      KEKs. the KEKs
      appropriate for the recipient.  In short, KEK_1(R1, S), ...,
      KEK_n(Rn, S), ENC(CEK, KEK_i) for i=1 to n, and ENC(firmware,CEK).
      The benefit of this approach is that the firmware image is
      encrypted only once with the a CEK while there is no sharing of the
      KEK accross recipients.  Hence, authorized recipients still need to use
      their individual KEKs to decrypt the CEK and to subsequently
      obtain the plaintext. plaintext firmware.

   -  The last third option is to use different CEKs encrypted with KEKs of
      the authorized recipients.  Assume there are KEK_1(R1, S),...,
      KEK_n(Rn, S), and for i=1 to n the following computations need to
      be made: ENC(CEK_i, KEK_i) and ENC(firmware,CEK_i).  This approach
      is appropriate when no benefits can be gained from encrypting and
      transmitting firmware images only once.  For example, firmware
      images may contain information unique to a device instance.

   Note that the AES-KW algorithm, as defined in Section 2.2.3.1 of
   [RFC3394], does not have public parameters that vary on a per-
   invocation basis.  Hence, the protected structure in the
   COSE_recipient is a byte string of zero length.

   The COSE_Encrypt conveys information for encrypting the firmware
   image, which includes information like the algorithm and the IV, even
   though the firmware image is not embedded in the
   COSE_Encrypt.ciphertext itself since it conveyed as detached content.

   The CDDL for the COSE_Encrypt_Tagged structure is shown in Figure 2. 4.

 COSE_Encrypt_Tagged = #6.96(COSE_Encrypt)

 SUIT_Encryption_Info = COSE_Encrypt_Tagged

 COSE_Encrypt = [
   protected   : bstr .cbor outer_header_map_protected,
   unprotected : outer_header_map_unprotected,
   ciphertext  : null,                  ; because of detached ciphertext
   recipients  : [ + COSE_recipient ]
 ]

 outer_header_map_protected =
 {
     1 => int,         ; algorithm identifier
   * label =values     ; extension point
 }

 outer_header_map_unprotected =
 {
     5 => bstr,        ; IV
   * label =values     ; extension point
 }

 COSE_recipient = [
   protected   : bstr .size 0,
   unprotected : recipient_header_map,
   ciphertext  : bstr        ; CEK encrypted with KEK
 ]

 recipient_header_map =
 {
     1 => int,         ; algorithm identifier
     4 => bstr,        ; key identifier
   * label =values     ; extension point
 }

                Figure 2: 4: CDDL for AES Key Wrap-based Firmware Wrap Encryption

   The COSE specification requires a consistent byte stream for the
   authenticated data structure to be created, which is shown in
   Figure 3. 5.

          Enc_structure = [
            context : "Encrypt",
            protected : empty_or_serialized_map,
            external_aad : bstr
          ]

              Figure 3: 5: CDDL for Enc_structure Data Structure

   As shown in Figure 2, 4, there are two protected fields: one protected
   field in the COSE_Encrypt structure and a second one in the
   COSE_recipient structure.  The 'protected' field in the
   Enc_structure, see Figure 3, 5, refers to the content of the protected
   field from the COSE_Encrypt structure, not to the protected field of
   the COSE_recipient structure.

   The value of the external_aad is MUST be set to null.

   The following example illustrates the use of the AES-KW algorithm
   with AES-128.

   We use the following parameters in this example:

   -  IV: 0x26, 0x68, 0x23, 0x06, 0xd4, 0xfb, 0x28, 0xca, 0x01, 0xb4,
      0x3b, 0x80

   -  KEK: "aaaaaaaaaaaaaaaa"

   -  KID: "kid-1"

   -  Plaintext Firmware: "This is a real firmware image."

   -  Firmware (hex):
      546869732069732061207265616C206669726D7761726520696D6167652E

   The COSE_Encrypt structure structure, in hex format format, is (with a line break
   inserted):

   D8608443A10101A1054C26682306D4FB28CA01B43B80F68340A2012204456B69642D
   315818AF09622B4F40F17930129D18D0CEA46F159C49E7F68B644D

   The resulting COSE_Encrypt structure in a dignostic format is shown
   in Figure 4. 6.

   96(
       [
           // protected field with alg=AES-GCM-128
           h'A10101',
           {
              // unprotected field with iv
              5: h'26682306D4FB28CA01B43B80'
           },
           // null because of detached ciphertext
           null,
           [ // recipients array
              h'', // protected field
              {    // unprotected field
                 1: -3,            // alg=A128KW
                 4: h'6B69642D31'  // key id
              },
              // CEK encrypted with KEK
              h'AF09622B4F40F17930129D18D0CEA46F159C49E7F68B644D'
           ]
       ]
   )

              Figure 4: 6: COSE_Encrypt Example for AES Key Wrap

   The CEK CEK, in hex format, was "4C805F1587D624ED5E0DBB7A7F7FA7EB" and
   the encrypted firmware (with a line feed added) was:

   A8B6E61EF17FBAD1F1BF3235B3C64C06098EA512223260
   F9425105F67F0FB6C92248AE289A025258F06C2AD70415

5.

6.  Hybrid Public-Key Encryption (HPKE)

   Hybrid public-key encryption (HPKE) [I-D.irtf-cfrg-hpke] is a scheme
   that provides public key encryption of arbitrary-sized plaintexts
   given a recipient's public key.

   For use with firmware encryption the scheme works as follows: The
   firmware author uses HPKE,
   which internally utilizes a non-
   interactive non-interactive ephemeral-static Diffie-Hellman Diffie-
   Hellman exchange to derive a shared secret, which is then used to encrypt plaintext.

   In a CEK.
   This CEK is subsequently used to encrypt the firmware encryption scenario, image.  Hence,
   the plaintext passed to HPKE for
   encryption is the randomly generated CEK.  The
   output of the HPKE
   operation SealBase function is therefore the encrypted CEK
   along with HPKE encapsulated key (i.e. the ephemeral ECDH public key of the author).  The CEK is
   then used to encrypt the firmware.
   key).

   Only the holder of recipient's private key can decapsulate the CEK to
   decrypt the firmware.  Key generation in HPKE is influced by
   additional parameters, such as identity information.

   This approach allows all recipients to use the same CEK to encrypt
   the firmware image, in case there are multiple recipients, to fulfill
   a requirement for the efficient distribution of firmware images using
   a multicast or broadcast protocol.

   The CDDL for

   [cose-hpke] defines the COSE_Encrypt structure as used with use of HPKE is shown in
   Figure 5. with COSE and this specification
   profiles it.

 COSE_Encrypt_Tagged = #6.96(COSE_Encrypt)

 SUIT_Encryption_Info = COSE_Encrypt_Tagged

 ; Layer 0
 COSE_Encrypt = [
   protected   : bstr .cbor header_map, ; must contain alg
   unprotected : header_map,            ; must contain iv
   ciphertext  : null,                  ; because of detached ciphertext
   recipients  : [ + COSE_recipient_outer ] [+COSE_recipient_outer]
 ]

 ; Layer 1
 COSE_recipient_outer = [
   protected   : bstr .size 0,
   unprotected : header_map, ; must contain alg
   ciphertext
   encCEK      : bstr bstr,       ; CEK encrypted based on HPKE algo
   recipients  : [ + COSE_recipient_inner ]
 ]

 ; Layer 2
 COSE_recipient_inner = [
   protected   : bstr .cbor header_map, ; must contain HPKE alg
   unprotected : header_map, ; must contain kid,
   ciphertext kid and ephemeral public key
   empty       : bstr        ; CEK encrypted based on HPKE algo
   recipients null,
   empty       : null
 ]

 header_map = {
   Generic_Headers,
   * label =values,
 }

 Generic_Headers = (
     ? 1 => int,         ; algorithm identifier
     ? 2 => crv,         ; EC identifier
     ? 4 => bstr,        ; key identifier
     ? 5 => bstr         ; IV
 )

           Figure 5: 7: CDDL for HPKE-based COSE_Encrypt Structure

   The COSE_Encrypt structure in Figure 5 requires the encrypted CEK and
   the ephemeral public key of the firmare author to be generated.  This
   is accomplished with the HPKE (layer 0) contains algorithm parameters
   for encryption function as shown in
   Figure 6.

       CEK = random()
       pkR = DeserializePublicKey(recipient_public_key)
       info = "cose hpke" || 0x00 || COSE_KDF_Context
       enc, context = SetupBaseS(pkR, info)
       ciphertext = context.Seal(null, CEK)

                                 Figure 6

   Legend:

   -  The functions DeserializePublicKey(), SetupBaseS() and Seal() are
      defined in HPKE [I-D.irtf-cfrg-hpke].

   -  CEK is a random byte sequence of keysize length whereby keysize
      corresponds to the size of the indicated symmetric encryption
      algorithm used for firmware encryption.  For example, AES-128-GCM
      requires a 16 byte key. image.  The CEK would therefore be 16 bytes long.

   -  'recipient_public_key' represents the public key of the recipient.

   -  'info' is a data structure described below used as input to the
      key derivation internal to protected field MUST
   contain the HPKE algorithm.  In addition to 'alg' parameter and the
      constant prefix, unprotected field MUST contain
   the COSE_KDF_Context structure is used. 'iv' parameter.  The
      COSE_KDF_Context ciphertext is shown in Figure 7. always detached.

   The result of the above-described operation is COSE_recipient_outer structure (layer 1) contains the encrypted CEK
   (denoted as ciphertext) and the enc - the HPKE encapsulated key (i.e.
   the ephemeral ECDH public key of the author).

   PartyInfo = (
      identity : bstr,
      nonce : nil,
      other : nil
   )

   COSE_KDF_Context = [
      AlgorithmID : int,
      PartyUInfo : [ PartyInfo ],
      PartyVInfo : [ PartyInfo ],
      SuppPubInfo : [
          keyDataLength : uint,
   CEK.  The protected : empty_or_serialized_map
      ],
   ]

                 Figure 7: COSE_KDF_Context Data Structure

   Notes:

   -  PartyUInfo.identity corresponds to the kid found in the
      COSE_Sign_Tagged or COSE_Sign1_Tagged structure (when a digital
      signature is used).  When utilizing a MAC, then MUST be empty and the kid is found
      in unprotected
   structure MUST contain the COSE_Mac_Tagged or COSE_Mac0_Tagged structure.

   -  PartyVInfo.identity corresponds to 'alg' parameter, which carries the kid used
   algorithm information for protecting the respective
      recipient from the inner-most recipients array.

   - CEK.

   The value in the AlgorithmID field corresponds to the alg
      parameter in COSE_recipient_inner structure (layer 2) contains the HPKE-
   related information.  The protected structure in MUST contain the inner-most recipients
      array.

   -  keyDataLength is 'alg'
   parameter set to the number of bits algorithm values in Section 6 of [cose-hpke] and
   the desired output
      value.

   -  protected refers to unprotected structure MUST contain the protected 'kid' and the 'ephemeral'
   parameter.

   To populate the SUIT_Encryption_Info structure of the inner-most
      array. sender creates a
   CEK randomly.  The author encrypts CEK is used to encrypt the firmware using the CEK image with the
   selected algorithm.

   The recipient decrypts the encrypted CEK, using two HPKE SealBase function takes various input parameters:

   - parameters, as
   explained in [cose-hpke].  The most important input parameters are
   the private key skR corresponding to plaintext (CEK in our case) and the public key pkR used by of the author when creating recipient.
   If successful, SealBase will return the manifest.

   - encrypted CEK and the HPKE encapsulated key (i.e.
   ephemeral ECDH public key) created
      by key.

   The recipient receives the author. ephemeral public key and the encrypted CEK
   from the sender.  It then uses the HPKE OpenBase function to decrypt
   the ciphertext (which contains the CEK).

   If the HPKE operation OpenBase function is successful, the recipient obtains
   the CEK and can decrypt the firmware.  The decryption operation is
   shown in Figure 8 shows the HPKE computations performed by the recipient for
   decryption.

       info = "cose hpke" || 0x00 || COSE_KDF_Context
       context = SetupBaseR(ciphertext, skR, info)
       CEK = context.Open(null, ciphertext)

                                 Figure 8 4 of [cose-hpke].

   An example of the COSE_Encrypt structure using the HPKE scheme is
   shown in Figure 9. 8.  It uses the following algorithm combination:

   -  AES-GCM-128 for encryption of the firmware image.

   -  AES-GCM-128 for encrytion of the CEK.

   -  Key Encapsulation Mechanism (KEM): NIST P-256

   -  Key Derivation Function (KDF): HKDF-SHA256

  96(
      [
          // protected field with alg=AES-GCM-128
          h'A10101',
          {    // unprotected field with iv
               5: h'26682306D4FB28CA01B43B80'
          },
          // null because of detached ciphertext
          null,
          [  // COSE_recipient_outer
              h'',          // empty protected field
              {             // unprotected field with ...
                   1: 1     //     alg=A128GCM
              },
              // Encrypted CEK
              h'FA55A50CF110908DA6443149F2C2062011A7D8333A72721A',
              [    // COSE_recipient_inner
                   // protected field with alg HPKE/P-256+HKDF-256 (new)
                   h'A1013818',
                   {  // unprotected field with ...
                      //    HPKE encapsulated key
                      -1: h'A4010220012158205F...979D51687187510C445',
                      //    kid for recipient static ECDH public key
                       4: h'6B69642D31'
                   },
                   // empty ciphertext
                   null
              ]
          ]
       ]
  )

                  Figure 9: 8: COSE_Encrypt Example for HPKE

6.

7.  CEK Verification

   The suit-cek-verification parameter contains a byte string resulting
   from the encryption of 8 bytes of 0xA5 using the CEK.

   [[Editor's Note: Guidance about the selection of an IV needs to be
   added here.]]

8.  Complete Examples

   TBD: Example

   [[Editor's Note: Add examples for a complete manifest here (which also includes the (including
   a digital signature).  TBD: Multiple recipient example as well.  TBD:
   Encryption signature), multiple recipients, encryption of manifest manifests
   (in addition of comparison to firmware encryption).

7. images).]]

9.  Security Considerations

   The algorithms described in this document assume that the party
   performing the firmware
   author encryption

   -  has either shared  shares a key-encryption key (KEK) with the firmware consumer (for
      use with the AES-Key Wrap scheme), or

   -  is in possession of the public key of the firmware consumer (for
      use with HPKE).

   Both cases require some upfront communication interaction, which is
   not part of the SUIT manifest.  This interaction is likely provided
   by an IoT device management solution, as described in [RFC9019].

   For AES-Key Wrap to provide high security it is important that the
   KEK is of high entropy, and that implementations protect the KEK from
   disclosure.  Compromise of the KEK may result in the disclosure of
   all key data protected with that KEK.

   Since the CEK is randomly generated, it must be ensured that the
   guidelines for random number generations are followed, see [RFC8937].

   In some cases third party companies analyse binaries for known
   security vulnerabilities.  With encrypted firmware images this type
   of analysis is prevented.  Consequently, these third party companies
   either need to be given access to the plaintext binary before
   encryption or they need to become authorized recipients of the
   encrypted firmware images.  In either case, it is necessary to
   explicitly consider those third parties in the software supply chain
   when such a binary analysis is desired.

8.

10.  IANA Considerations

   This document requests IANA to create new entries in the COSE
   Algorithms registry established with [I-D.ietf-cose-rfc8152bis-algs].

 +-------------+-------+---------+------------+--------+---------------+
 | Name        | Value | KDF     | Ephemeral- | Key    | Description   |
 |             |       |         | Static     | Wrap   |               |
 +-------------+-------+---------+------------+--------+---------------+
 | HPKE/P-256+ | TBD1  | HKDF -  | yes        | none   | HPKE with     |
 | HKDF-256    |       | SHA-256 |            |        | ECDH-ES       |
 |             |       |         |            |        | (P-256) +     |
 |             |       |         |            |        | HKDF-256      |
 +-------------+-------+---------+------------+--------+---------------+
 | HPKE/P-384+ | TBD2  | HKDF -  | yes        | none   | HPKE with     |
 | HKDF-SHA384 |       | SHA-384 |            |        | ECDH-ES       |
 |             |       |         |            |        | (P-384) +     |
 |             |       |         |            |        | HKDF-384      |
 +-------------+-------+---------+------------+--------+---------------+
 | HPKE/P-521+ | TBD3  | HKDF -  | yes        | none   | HPKE with     |
 | HKDF-SHA521 |       | SHA-521 |            |        | ECDH-ES       |
 |             |       |         |            |        | (P-521) +     |
 |             |       |         |            |        | HKDF-521      |
 +-------------+-------+---------+------------+--------+---------------+
 | HPKE        | TBD4  | HKDF -  | yes        | none   | HPKE with     |
 | X25519 +    |       | SHA-256 |            |        | ECDH-ES       |
 | HKDF-SHA256 |       |         |            |        | (X25519) +    |
 |             |       |         |            |        | HKDF-256      |
 +-------------+-------+---------+------------+--------+---------------+
 | HPKE        | TBD4  | HKDF -  | yes        | none   | HPKE with     |
 | X448 +      |       | SHA-512 |            |        | ECDH-ES       |
 | HKDF-SHA512 |       |         |            |        | (X448) +      |
 |             |       |         |            |        | HKDF-512      |
 +-------------+-------+---------+------------+--------+---------------+

9. does not require any actions by IANA.

11.  References

9.1.

11.1.  Normative References

   [I-D.ietf-cose-rfc8152bis-algs]
              Schaad, J., "CBOR

   [cose-hpke]
              Tschofenig, H., Housley, R., and B. Moran, "Use of Hybrid
              Public-Key Encryption (HPKE) with CBOR Object Signing and
              Encryption (COSE):
              Initial Algorithms", draft-ietf-cose-rfc8152bis-algs-12
              (work in progress), September 2020. (COSE)", October 2021,
              <https://datatracker.ietf.org/doc/html/
              draft-tschofenig-cose-hpke-00>.

   [I-D.ietf-suit-manifest]
              Moran, B., Tschofenig, H., Birkholz, H.,
              Arm Limited, Arm Limited, Fraunhofer SIT, and K. Zandberg, Inria, "A
              Concise Binary Object Representation (CBOR)-based
              Serialization Format for the Software Updates for Internet
              of Things (SUIT) Manifest", draft-ietf-suit-manifest-12 draft-ietf-suit-manifest-14
              (work in progress), February July 2021.

   [I-D.irtf-cfrg-hpke]
              Barnes, R. L., Bhargavan, K., Lipp, B.,
              Cisco, Inria, Inria, and C. A. Wood, Cloudflare, "Hybrid Public Key
              Encryption", draft-irtf-cfrg-hpke-08 draft-irtf-cfrg-hpke-12 (work in progress), February
              September 2021.

   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119,
              DOI 10.17487/RFC2119, March 1997,
              <https://www.rfc-editor.org/info/rfc2119>.

   [RFC3394]  Schaad, J. and R. Housley, "Advanced Encryption Standard
              (AES) Key Wrap Algorithm", RFC 3394, DOI 10.17487/RFC3394,
              September 2002, <https://www.rfc-editor.org/info/rfc3394>.

   [RFC8152]  Schaad, J., "CBOR Object Signing and Encryption (COSE)",
              RFC 8152, DOI 10.17487/RFC8152, July 2017,
              <https://www.rfc-editor.org/info/rfc8152>.

   [RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
              2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
              May 2017, <https://www.rfc-editor.org/info/rfc8174>.

9.2.

11.2.  Informative References

   [I-D.ietf-suit-information-model]
              Moran, B., Tschofenig, H.,
              Arm Limited, Arm Limited, and H. Birkholz, Fraunhofer SIT, "A Manifest
              Information Model for Firmware Updates in IoT Devices",
              draft-ietf-suit-information-model-11
              draft-ietf-suit-information-model-13 (work in progress),
              April
              July 2021.

   [RFC2630]  Housley, R., "Cryptographic Message Syntax", RFC 2630,
              DOI 10.17487/RFC2630, June 1999,
              <https://www.rfc-editor.org/info/rfc2630>.

   [RFC4949]  Shirey, R., "Internet Security Glossary, Version 2",
              FYI 36, RFC 4949, DOI 10.17487/RFC4949, August 2007,
              <https://www.rfc-editor.org/info/rfc4949>.

   [RFC8937]  Cremers, C., Garratt, L., Smyshlyaev, S., Sullivan, N.,
              and C. Wood, "Randomness Improvements for Security
              Protocols", RFC 8937, DOI 10.17487/RFC8937, October 2020,
              <https://www.rfc-editor.org/info/rfc8937>.

   [RFC9019]  Moran, B., Tschofenig, H., Brown, D., and M. Meriac, "A
              Firmware Update Architecture for Internet of Things",
              RFC 9019, DOI 10.17487/RFC9019, April 2021,
              <https://www.rfc-editor.org/info/rfc9019>.

Appendix A.  Acknowledgements

   We would like to thank Henk Birkholz for his feedback on the CDDL
   description in this document.  Additionally, we would like to thank
   Michael Richardson and Carsten Bormann for their review feedback.
   Finally, we would like to thank Dick Brooks for making us aware of
   the challenges firmware encryption imposes on binary analysis.

Authors' Addresses

   Hannes Tschofenig
   Arm Limited

   EMail: hannes.tschofenig@arm.com

   Russ Housley
   Vigil Security, LLC

   EMail: housley@vigilsec.com

   Brendan Moran
   Arm Limited

   EMail: Brendan.Moran@arm.com