< draft-ietf-suit-firmware-encryption-01.txt		draft-ietf-suit-firmware-encryption-02.txt >
	SUIT H. Tschofenig		SUIT H. Tschofenig
	Internet-Draft Arm Limited		Internet-Draft Arm Limited
	Intended status: Standards Track R. Housley		Intended status: Standards Track R. Housley
	Expires: January 13, 2022 Vigil Security		Expires: April 28, 2022 Vigil Security
	B. Moran		B. Moran
	Arm Limited		Arm Limited
	July 12, 2021		October 25, 2021
	Firmware Encryption with SUIT Manifests		Firmware Encryption with SUIT Manifests
	draft-ietf-suit-firmware-encryption-01		draft-ietf-suit-firmware-encryption-02
	Abstract		Abstract
	This document specifies a firmware update mechanism where the		This document specifies a firmware update mechanism where the
	firmware image is encrypted. This mechanism uses the IETF SUIT		firmware image is encrypted. Firmware encryption uses the IETF SUIT
	manifest with key establishment provided by the hybrid public-key		manifest with key establishment provided by the hybrid public-key
	encryption (HPKE) scheme or AES Key Wrap (AES-KW) with a pre-shared		encryption (HPKE) scheme and the AES Key Wrap (AES-KW) with a pre-
	key-encryption key. In either case, AES-GCM or AES-CCM is used for		shared key-encryption key. Encryption of the firmware image is
	firmware encryption.		encrypted using AES-GCM or AES-CCM.
	Status of This Memo		Status of This Memo
	This Internet-Draft is submitted in full conformance with the		This Internet-Draft is submitted in full conformance with the
	provisions of BCP 78 and BCP 79.		provisions of BCP 78 and BCP 79.
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute		Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-		working documents as Internet-Drafts. The list of current Internet-
	Drafts is at https://datatracker.ietf.org/drafts/current/.		Drafts is at https://datatracker.ietf.org/drafts/current/.
	Internet-Drafts are draft documents valid for a maximum of six months		Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any		and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference		time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."		material or to cite them other than as "work in progress."
	This Internet-Draft will expire on January 13, 2022.		This Internet-Draft will expire on April 28, 2022.
	Copyright Notice		Copyright Notice
	Copyright (c) 2021 IETF Trust and the persons identified as the		Copyright (c) 2021 IETF Trust and the persons identified as the
	document authors. All rights reserved.		document authors. All rights reserved.
	This document is subject to BCP 78 and the IETF Trust's Legal		This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents		Provisions Relating to IETF Documents
	(https://trustee.ietf.org/license-info) in effect on the date of		(https://trustee.ietf.org/license-info) in effect on the date of
	publication of this document. Please review these documents		publication of this document. Please review these documents
	skipping to change at page 2, line 26 ¶		skipping to change at page 2, line 26 ¶
	outside the IETF Standards Process, and derivative works of it may		outside the IETF Standards Process, and derivative works of it may
	not be created outside the IETF Standards Process, except to format		not be created outside the IETF Standards Process, except to format
	it for publication as an RFC or to translate it into languages other		it for publication as an RFC or to translate it into languages other
	than English.		than English.
	Table of Contents		Table of Contents
	1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2		1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
	2. Conventions and Terminology . . . . . . . . . . . . . . . . . 3		2. Conventions and Terminology . . . . . . . . . . . . . . . . . 3
	3. Architecture . . . . . . . . . . . . . . . . . . . . . . . . 4		3. Architecture . . . . . . . . . . . . . . . . . . . . . . . . 4
	4. AES Key Wrap . . . . . . . . . . . . . . . . . . . . . . . . 5		4. SUIT Envelope and SUIT Manifest . . . . . . . . . . . . . . . 6
	5. Hybrid Public-Key Encryption (HPKE) . . . . . . . . . . . . . 9		5. AES Key Wrap . . . . . . . . . . . . . . . . . . . . . . . . 7
	6. Complete Examples . . . . . . . . . . . . . . . . . . . . . . 14		6. Hybrid Public-Key Encryption (HPKE) . . . . . . . . . . . . . 11
	7. Security Considerations . . . . . . . . . . . . . . . . . . . 15		7. CEK Verification . . . . . . . . . . . . . . . . . . . . . . 15
	8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 15		8. Complete Examples . . . . . . . . . . . . . . . . . . . . . . 15
	9. References . . . . . . . . . . . . . . . . . . . . . . . . . 16		9. Security Considerations . . . . . . . . . . . . . . . . . . . 16
	9.1. Normative References . . . . . . . . . . . . . . . . . . 16		10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16
	9.2. Informative References . . . . . . . . . . . . . . . . . 17		11. References . . . . . . . . . . . . . . . . . . . . . . . . . 16
	Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 18		11.1. Normative References . . . . . . . . . . . . . . . . . . 16
	Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 18		11.2. Informative References . . . . . . . . . . . . . . . . . 17
			Appendix A. Acknowledgements . . . . . . . . . . . . . . . . . . 19
			Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 19
	1. Introduction		1. Introduction
	Vulnerabilities with Internet of Things (IoT) devices have raised the		Vulnerabilities with Internet of Things (IoT) devices have raised the
	need for a reliable and secure firmware update mechanism that is also		need for a reliable and secure firmware update mechanism that is also
	suitable for constrained devices. To protect firmware images the		suitable for constrained devices. To protect firmware images the
	SUIT manifest format was developed [I-D.ietf-suit-manifest]. The		SUIT manifest format was developed [I-D.ietf-suit-manifest]. The
	SUIT manifest provides a bundle of metadata about the firmware for an		SUIT manifest provides a bundle of metadata about the firmware for an
	IoT device, where to find the firmware image, and the devices to		IoT device, where to find the firmware image, and the devices to
	which it applies.		which it applies.
	The SUIT information model [I-D.ietf-suit-information-model] details		The SUIT information model [I-D.ietf-suit-information-model] details
	the information that has to be offered by the SUIT manifest format.		the information that has to be offered by the SUIT manifest format.
	In addition to offering protection against modification, which is		In addition to offering protection against modification, which is
	provided by a digital signature or a message authentication code, the		provided by a digital signature or a message authentication code, the
	firmware image may also be afforded confidentiality using encryption.		firmware image may also be afforded confidentiality using encryption.
	Encryption prevents third parties, including attackers, from gaining		Encryption prevents third parties, including attackers, from gaining
	access to the firmware image. For example, return-oriented		access to the firmware binary. Hackers typically need intimate
	programming (ROP) requires intimate knowledge of the target firmware		knowledge of the target firmware to mount their attacks. For
	and encryption makes this approach much more difficult to exploit.		example, return-oriented programming (ROP) requires access to the
			binary and encryption makes it much more difficult to write exploits.
	The SUIT manifest provides the data needed for authorized recipients		The SUIT manifest provides the data needed for authorized recipients
	of the firmware image to decrypt it.		of the firmware image to decrypt it. The firmware image is encrypted
			using a symmetric key. This symmetric cryptographic key is
			established for encryption and decryption, and that key can be
			applied to a SUIT manifest, firmware images, or personalization data,
			depending on the encryption choices of the firmware author.
	A symmetric cryptographic key is established for encryption and		A symmetric key can be established using a variety of mechanisms;
	decryption, and that key can be applied to a SUIT manifest, firmware		this document defines two approaches for use with the IETF SUIT
	images, or personalization data, depending on the encryption choices		manifest, namely:
	of the firmware author. This symmetric key can be established using
	a variety of mechanisms; this document defines two approaches for use
	with the IETF SUIT manifest. Key establishment can be provided by
	the hybrid public-key encryption (HPKE) scheme or AES Key Wrap (AES-
	KW) with a pre-shared key-encryption key. These choices reduce the
	number of possible key establishment options and thereby help
	increase interoperability between different SUIT manifest parser
	implementations.
	The document also contains a number of examples for developers.		- hybrid public-key encryption (HPKE), and
			- AES Key Wrap (AES-KW) using a pre-shared key-encryption key (KEK).
			These choices reduce the number of possible key establishment options
			and thereby help increase interoperability between different SUIT
			manifest parser implementations.
			The document also contains a number of examples.
	2. Conventions and Terminology		2. Conventions and Terminology
	The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",		The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
	"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and		"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
	"OPTIONAL" in this document are to be interpreted as described in		"OPTIONAL" in this document are to be interpreted as described in
	BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all		BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
	capitals, as shown here.		capitals, as shown here.
	This document assumes familiarity with the IETF SUIT manifest		This document assumes familiarity with the IETF SUIT manifest
	[I-D.ietf-suit-manifest] and the SUIT architecture [RFC9019].		[I-D.ietf-suit-manifest], the SUIT information model
			[I-D.ietf-suit-information-model] and the SUIT architecture
			[RFC9019].
	In context of encryption, the terms "recipient" and "firmware		The terms sender and recipient are defined in [I-D.irtf-cfrg-hpke]
	consumer" are used interchangeably.		and have the following meaning:
			- Sender: Role of entity which sends an encrypted message.
			- Recipient: Role of entity which receives an encrypted message.
	Additionally, the following abbreviations are used in this document:		Additionally, the following abbreviations are used in this document:
	- Key Wrap (KW), defined in RFC 3394 [RFC3394] for use with AES.		- Key Wrap (KW), defined in RFC 3394 [RFC3394] for use with AES.
	- Key-encryption key / key-encrypting key (KEK), a term defined in		- Key-encryption key (KEK), a term defined in RFC 4949 [RFC4949].
	RFC 4949 [RFC4949].
	- Content-encryption key (CEK), a term defined in RFC 2630		- Content-encryption key (CEK), a term defined in RFC 2630
	[RFC2630].		[RFC2630].
	- Hybrid Public Key Encryption (HPKE), defined in		- Hybrid Public Key Encryption (HPKE), defined in
	[I-D.irtf-cfrg-hpke].		[I-D.irtf-cfrg-hpke].
	3. Architecture		3. Architecture
	Figure 1 in [RFC9019] shows the architecture for distributing		[RFC9019] describes the architecture for distributing firmware images
	firmware images and manifests from the author to the firmware		and manifests from the author to the firmware consumer. It does,
	consumer. It does, however, not detail the use of encrypted firmware		however, not detail the use of encrypted firmware images.
	images. Figure 1 therefore focuses on those aspects. The firmware
	server and the device management infrastructure is represented by the
	distribution system, which is aware of the individual devices a
	firmware update has to be delivered to.
	Firmware encryption requires the party doing the encryption to know
	either the KEK (in case of AES-KW) or the public key of the recipient
	(in case of HPKE). The firmware author may have knowledge about all
	the devices but in most cases this will not be likely. Hence, it is
	the responsibility of the distribution system to perform the firmware
	encryption.
	Since including the COSE_Encrypt structure in the manifest		This document enhances the SUIT architecutre to include firmware
	invalidates a a digital signature or a MAC added by the author, this		encryption. Figure 1 shows the distribution system, which represents
	structure needs to be added to the envelope by the distribution		the firmware server and the device management infrastructure. The
	system. This approach offers flexiblity when the number of devices		distribution system is aware of the individual devices to which a
	that need to receive encrypted firmware images changes dynamically or		firmware update has to be delivered.
	when the updates to KEKs or recipient public keys are necessary. As
	a downside, the author needs to trust the distribution system with
	performing the encryption of the plaintext firmware image.
	+----------+		+----------+
	| |		| |
	| Author |		| Author |
	| |		| |
	+----------+ +----------+		+----------+ +----------+
	| | |		| Device |---+ |
	| Device |---+ | Firmware +		|(Firmware | | | Firmware +
	| | | | Manifest		| Consumer)| | | Manifest
	+----------+ | |		+----------+ | |
	| |		| |
	| +--------------+		| +--------------+
	+----------+ | | |		| | |
	| | | Firmware + Manifest | Distribution |		+----------+ | Firmware + Manifest | Distribution |
	| Device |---+------------------------| System |		| Device |---+------------------------| System |
	| | | | |		|(Firmware | | | |
			| Consumer)| | | |
	+----------+ | +--------------+		+----------+ | +--------------+
	|		|
	|		|
	+----------+ |		+----------+ |
	| | |
	| Device +---+		| Device +---+
	| |		|(Firmware |
			| Consumer)|
	+----------+		+----------+
	Figure 1: Firmware Encryption Architecture.		Figure 1: Firmware Encryption Architecture.
	4. AES Key Wrap		Firmware encryption requires the sender to know the firmware
			consumers and the respective credentials used by the key distribution
			mechanism. For AES-KW the KEK needs to be known and, in case of
			HPKE, the sender needs to be in possession of the public key of the
			recipient.
			The firmware author may have knowledge about all devices that need to
			receive an encrypted firmware image but in most cases this will not
			be likely. The distribution system certainly has the knowledge about
			the recipients to perform firmware encryption.
			To offer confidentiality protection for firmware images two
			deployment variants need to be supported:
			- The firmware author acts as the sender and the recipient is the
			firmware consumer (or the firmware consumers).
			- The firmware author encrypts the firmware image with the
			distribution system as the initial recipient. Then, the
			distribution system decrypts and re-encrypts the firmware image
			towards the firmware consumer(s). Delegating the task of re-
			encrypting the firmware image to the distribution system offers
			flexiblity when the number of devices that need to receive
			encrypted firmware images changes dynamically or when updates to
			KEKs or recipient public keys are necessary. As a downside, the
			author needs to trust the distribution system with performing the
			re-encryption of the firmware image.
			Irrespectively of the two variants, the key distribution data (in
			form of the COSE_Encrypt structure) is included in the SUIT envelope
			rather than in the SUIT manifest since the manifest will be digitally
			signed (or MACed) by the firmware author.
			Since the SUIT envelope is not protected cryptographically an
			adversary could modify the COSE_Encrypt structure. For example, if
			the attacker alters the key distribution data then a recipient will
			decrypt the firmware image with an incorrect key. This will lead to
			expending energy and flash cycles until the failure is detected. To
			mitigate this attack, the optional suit-cek-verification parameter is
			added to the manifest. Since the manifest is protected by a digital
			signature (or a MAC), an adversary cannot successfully modify this
			value. This parameter allows the recipient to verify whether the CEK
			has successfully been derived.
			Details about the changes to the envelope and the manifest can be
			found in the next section.
			4. SUIT Envelope and SUIT Manifest
			This specification introduces two extensions to the SUIT envelope and
			the manifest structure, as motivated in Section 3.
			The SUIT envelope is enhanced with a key exchange payload, which is
			carried inside the suit-protection-wrappers parameter, see Figure 2.
			One or multiple SUIT_Encryption_Info payload(s) are carried within
			the suit-protection-wrappers parameter. The content of the
			SUIT_Encryption_Info payload is explained in Section 5 (for AES-KW)
			and in Section 6 (for HPKE). When the encryption capability is used,
			the suit-protection-wrappers parameter MUST be included in the
			envelope.
			SUIT_Envelope_Tagged = #6.107(SUIT_Envelope)
			SUIT_Envelope = {
			suit-authentication-wrapper => bstr .cbor SUIT_Authentication,
			suit-manifest => bstr .cbor SUIT_Manifest,
			SUIT_Severable_Manifest_Members,
			suit-protection-wrappers => bstr .cbor {
			*(int/str) => [+ SUIT_Encryption_Info]
			}
			* SUIT_Integrated_Payload,
			* SUIT_Integrated_Dependency,
			* $$SUIT_Envelope_Extensions,
			* (int => bstr)
			}
			Figure 2: SUIT Envelope CDDL.
			The manifest is extended with a CEK verification parameter (called
			suit-cek-verification), see Figure 3. This parameter is optional and
			is utilized in environments where battery exhaustion attacks are a
			concern. Details about the CEK verification can be found in
			Section 7.
			SUIT_Manifest = {
			suit-manifest-version => 1,
			suit-manifest-sequence-number => uint,
			suit-common => bstr .cbor SUIT_Common,
			? suit-reference-uri => tstr,
			? suit-cek-verification => bstr,
			SUIT_Severable_Members_Choice,
			SUIT_Unseverable_Members,
			* $$SUIT_Manifest_Extensions,
			}
			Figure 3: SUIT Manifest CDDL.
			5. AES Key Wrap
	The AES Key Wrap (AES-KW) algorithm is described in RFC 3394		The AES Key Wrap (AES-KW) algorithm is described in RFC 3394
	[RFC3394], and it can be used to encrypt a randomly generated		[RFC3394], and it can be used to encrypt a randomly generated
	content-encryption key (CEK) with a pre-shared key-encryption key		content-encryption key (CEK) with a pre-shared key-encryption key
	(KEK). The COSE conventions for using AES-KW are specified in		(KEK). The COSE conventions for using AES-KW are specified in
	Section 12.2.1 of [RFC8152]. The encrypted CEK is carried in the		Section 12.2.1 of [RFC8152]. The encrypted CEK is carried in the
	COSE_recipient structure alongside the information needed for AES-KW.		COSE_recipient structure alongside the information needed for AES-KW.
	The COSE_recipient structure, which is a substructure of the		The COSE_recipient structure, which is a substructure of the
	COSE_Encrypt structure, contains the CEK encrypted by the KEK.		COSE_Encrypt structure, contains the CEK encrypted by the KEK.
	When the firmware image is encrypted for use by multiple recipients,		When the firmware image is encrypted for use by multiple recipients,
	there are three options:		there are three options. We use the following notation KEK(R1,S) is
			the KEK shared between recipient R1 and the sender S. Likewise,
			CEK(R1,S) is shared between R1 and S. If a single CEK or a single
			KEK is shared with all authorized recipients R by a given sender S in
			a certain context then we use CEK(_,S) or KEK(_,S), respectively.
			The notation ENC(plaintext, key) refers to the encryption of
			plaintext with a given key.
	- If all of authorized recipients have access to the KEK, a single		- If all authorized recipients have access to the KEK, a single
	COSE_recipient structure contains the encrypted CEK.		COSE_recipient structure contains the encrypted CEK. This means
			KEK(*,S) ENC(CEK,KEK), and ENC(firmware,CEK).
	- If recipients have different KEKs, then the COSE_recipient		- If recipients have different KEKs, then multiple COSE_recipient
	structure may contain the same CEK encrypted with many different		structures are included but only a single CEK is used. Each
	KEKs. The benefit of this approach is that the firmware image is		COSE_recipient structure contains the CEK encrypted with the KEKs
	encrypted only once with the CEK while the authorized recipients		appropriate for the recipient. In short, KEK_1(R1, S), ...,
	still need to use their individual KEKs to obtain the plaintext.		KEK_n(Rn, S), ENC(CEK, KEK_i) for i=1 to n, and ENC(firmware,CEK).
			The benefit of this approach is that the firmware image is
			encrypted only once with a CEK while there is no sharing of the
			KEK accross recipients. Hence, authorized recipients still use
			their individual KEKs to decrypt the CEK and to subsequently
			obtain the plaintext firmware.
	- The last option is to use different CEKs encrypted with KEKs of		- The third option is to use different CEKs encrypted with KEKs of
	the authorized recipients. This is appropriate when no benefits		the authorized recipients. Assume there are KEK_1(R1, S),...,
	can be gained from encrypting and transmitting firmware images		KEK_n(Rn, S), and for i=1 to n the following computations need to
	only once. For example, firmware images may contain information		be made: ENC(CEK_i, KEK_i) and ENC(firmware,CEK_i). This approach
	unique to a device instance.		is appropriate when no benefits can be gained from encrypting and
			transmitting firmware images only once. For example, firmware
			images may contain information unique to a device instance.
	Note that the AES-KW algorithm, as defined in Section 2.2.3.1 of		Note that the AES-KW algorithm, as defined in Section 2.2.3.1 of
	[RFC3394], does not have public parameters that vary on a per-		[RFC3394], does not have public parameters that vary on a per-
	invocation basis. Hence, the protected structure in the		invocation basis. Hence, the protected structure in the
	COSE_recipient is a byte string of zero length.		COSE_recipient is a byte string of zero length.
	The COSE_Encrypt conveys information for encrypting the firmware		The COSE_Encrypt conveys information for encrypting the firmware
	image, which includes information like the algorithm and the IV, even		image, which includes information like the algorithm and the IV, even
	though the firmware image is not embedded in the		though the firmware image is not embedded in the
	COSE_Encrypt.ciphertext itself since it conveyed as detached content.		COSE_Encrypt.ciphertext itself since it conveyed as detached content.
	The CDDL for the COSE_Encrypt_Tagged structure is shown in Figure 2.		The CDDL for the COSE_Encrypt_Tagged structure is shown in Figure 4.
	COSE_Encrypt_Tagged = #6.96(COSE_Encrypt)		COSE_Encrypt_Tagged = #6.96(COSE_Encrypt)
	SUIT_Encryption_Info = COSE_Encrypt_Tagged		SUIT_Encryption_Info = COSE_Encrypt_Tagged
	COSE_Encrypt = [		COSE_Encrypt = [
	protected : bstr .cbor outer_header_map_protected,		protected : bstr .cbor outer_header_map_protected,
	unprotected : outer_header_map_unprotected,		unprotected : outer_header_map_unprotected,
	ciphertext : null, ; because of detached ciphertext		ciphertext : null, ; because of detached ciphertext
	recipients : [ + COSE_recipient ]		recipients : [ + COSE_recipient ]
	skipping to change at page 7, line 41 ¶		skipping to change at page 9, line 41 ¶
	ciphertext : bstr ; CEK encrypted with KEK		ciphertext : bstr ; CEK encrypted with KEK
	]		]
	recipient_header_map =		recipient_header_map =
	{		{
	1 => int, ; algorithm identifier		1 => int, ; algorithm identifier
	4 => bstr, ; key identifier		4 => bstr, ; key identifier
	* label =values ; extension point		* label =values ; extension point
	}		}
	Figure 2: CDDL for AES Key Wrap-based Firmware Encryption		Figure 4: CDDL for AES Key Wrap Encryption
	The COSE specification requires a consistent byte stream for the		The COSE specification requires a consistent byte stream for the
	authenticated data structure to be created, which is shown in		authenticated data structure to be created, which is shown in
	Figure 3.		Figure 5.
	Enc_structure = [		Enc_structure = [
	context : "Encrypt",		context : "Encrypt",
	protected : empty_or_serialized_map,		protected : empty_or_serialized_map,
	external_aad : bstr		external_aad : bstr
	]		]
	Figure 3: CDDL for Enc_structure Data Structure		Figure 5: CDDL for Enc_structure Data Structure
	As shown in Figure 2, there are two protected fields: one protected		As shown in Figure 4, there are two protected fields: one protected
	field in the COSE_Encrypt structure and a second one in the		field in the COSE_Encrypt structure and a second one in the
	COSE_recipient structure. The 'protected' field in the		COSE_recipient structure. The 'protected' field in the
	Enc_structure, see Figure 3, refers to the content of the protected		Enc_structure, see Figure 5, refers to the content of the protected
	field from the COSE_Encrypt structure, not to the protected field of		field from the COSE_Encrypt structure.
	the COSE_recipient structure.
	The value of the external_aad is set to null.		The value of the external_aad MUST be set to null.
	The following example illustrates the use of the AES-KW algorithm		The following example illustrates the use of the AES-KW algorithm
	with AES-128.		with AES-128.
	We use the following parameters in this example:		We use the following parameters in this example:
	- IV: 0x26, 0x68, 0x23, 0x06, 0xd4, 0xfb, 0x28, 0xca, 0x01, 0xb4,		- IV: 0x26, 0x68, 0x23, 0x06, 0xd4, 0xfb, 0x28, 0xca, 0x01, 0xb4,
	0x3b, 0x80		0x3b, 0x80
	- KEK: "aaaaaaaaaaaaaaaa"		- KEK: "aaaaaaaaaaaaaaaa"
	- KID: "kid-1"		- KID: "kid-1"
	- Plaintext Firmware: "This is a real firmware image."		- Plaintext Firmware: "This is a real firmware image."
	- Firmware (hex):		- Firmware (hex):
	546869732069732061207265616C206669726D7761726520696D6167652E		546869732069732061207265616C206669726D7761726520696D6167652E
	The COSE_Encrypt structure in hex format is (with a line break		The COSE_Encrypt structure, in hex format, is (with a line break
	inserted):		inserted):
	D8608443A10101A1054C26682306D4FB28CA01B43B80F68340A2012204456B69642D		D8608443A10101A1054C26682306D4FB28CA01B43B80F68340A2012204456B69642D
	315818AF09622B4F40F17930129D18D0CEA46F159C49E7F68B644D		315818AF09622B4F40F17930129D18D0CEA46F159C49E7F68B644D
	The resulting COSE_Encrypt structure in a dignostic format is shown		The resulting COSE_Encrypt structure in a dignostic format is shown
	in Figure 4.		in Figure 6.
	96(		96(
	[		[
	// protected field with alg=AES-GCM-128		// protected field with alg=AES-GCM-128
	h'A10101',		h'A10101',
	{		{
	// unprotected field with iv		// unprotected field with iv
	5: h'26682306D4FB28CA01B43B80'		5: h'26682306D4FB28CA01B43B80'
	},		},
	// null because of detached ciphertext		// null because of detached ciphertext
	skipping to change at page 9, line 27 ¶		skipping to change at page 11, line 27 ¶
	{ // unprotected field		{ // unprotected field
	1: -3, // alg=A128KW		1: -3, // alg=A128KW
	4: h'6B69642D31' // key id		4: h'6B69642D31' // key id
	},		},
	// CEK encrypted with KEK		// CEK encrypted with KEK
	h'AF09622B4F40F17930129D18D0CEA46F159C49E7F68B644D'		h'AF09622B4F40F17930129D18D0CEA46F159C49E7F68B644D'
	]		]
	]		]
	)		)
	Figure 4: COSE_Encrypt Example for AES Key Wrap		Figure 6: COSE_Encrypt Example for AES Key Wrap
	The CEK was "4C805F1587D624ED5E0DBB7A7F7FA7EB" and the encrypted		The CEK, in hex format, was "4C805F1587D624ED5E0DBB7A7F7FA7EB" and
	firmware was:		the encrypted firmware (with a line feed added) was:
	A8B6E61EF17FBAD1F1BF3235B3C64C06098EA512223260		A8B6E61EF17FBAD1F1BF3235B3C64C06098EA512223260
	F9425105F67F0FB6C92248AE289A025258F06C2AD70415		F9425105F67F0FB6C92248AE289A025258F06C2AD70415
	5. Hybrid Public-Key Encryption (HPKE)		6. Hybrid Public-Key Encryption (HPKE)
	Hybrid public-key encryption (HPKE) [I-D.irtf-cfrg-hpke] is a scheme		Hybrid public-key encryption (HPKE) [I-D.irtf-cfrg-hpke] is a scheme
	that provides public key encryption of arbitrary-sized plaintexts		that provides public key encryption of arbitrary-sized plaintexts
	given a recipient's public key.		given a recipient's public key.
	For use with firmware encryption the scheme works as follows: The		For use with firmware encryption the scheme works as follows: HPKE,
	firmware author uses HPKE, which internally utilizes a non-		which internally utilizes a non-interactive ephemeral-static Diffie-
	interactive ephemeral-static Diffie-Hellman exchange to derive a		Hellman exchange to derive a shared secret, is used to encrypt a CEK.
	shared secret, which is then used to encrypt plaintext.		This CEK is subsequently used to encrypt the firmware image. Hence,
			the plaintext passed to HPKE is the randomly generated CEK. The
	In the firmware encryption scenario, the plaintext passed to HPKE for		output of the HPKE SealBase function is therefore the encrypted CEK
	encryption is the randomly generated CEK. The output of the HPKE		along with HPKE encapsulated key (i.e. the ephemeral ECDH public
	operation is therefore the encrypted CEK along with HPKE encapsulated		key).
	key (i.e. the ephemeral ECDH public key of the author). The CEK is
	then used to encrypt the firmware.
	Only the holder of recipient's private key can decapsulate the CEK to		Only the holder of recipient's private key can decapsulate the CEK to
	decrypt the firmware. Key generation is influced by additional		decrypt the firmware. Key generation in HPKE is influced by
	parameters, such as identity information.		additional parameters, such as identity information.
	This approach allows all recipients to use the same CEK to encrypt		This approach allows all recipients to use the same CEK to encrypt
	the firmware image, in case there are multiple recipients, to fulfill		the firmware image, in case there are multiple recipients, to fulfill
	a requirement for the efficient distribution of firmware images using		a requirement for the efficient distribution of firmware images using
	a multicast or broadcast protocol.		a multicast or broadcast protocol.
	The CDDL for the COSE_Encrypt structure as used with HPKE is shown in		[cose-hpke] defines the use of HPKE with COSE and this specification
	Figure 5.		profiles it.
	COSE_Encrypt_Tagged = #6.96(COSE_Encrypt)		COSE_Encrypt_Tagged = #6.96(COSE_Encrypt)
	SUIT_Encryption_Info = COSE_Encrypt_Tagged		SUIT_Encryption_Info = COSE_Encrypt_Tagged
			; Layer 0
	COSE_Encrypt = [		COSE_Encrypt = [
	protected : bstr .cbor header_map, ; must contain alg		protected : bstr .cbor header_map, ; must contain alg
	unprotected : header_map, ; must contain iv		unprotected : header_map, ; must contain iv
	ciphertext : null, ; because of detached ciphertext		ciphertext : null, ; because of detached ciphertext
	recipients : [ + COSE_recipient_outer ]		recipients : [+COSE_recipient_outer]
	]		]
			; Layer 1
	COSE_recipient_outer = [		COSE_recipient_outer = [
	protected : bstr .size 0,		protected : bstr .size 0,
	unprotected : header_map, ; must contain alg		unprotected : header_map, ; must contain alg
	ciphertext : bstr ; CEK encrypted based on HPKE algo		encCEK : bstr, ; CEK encrypted based on HPKE algo
	recipients : [ + COSE_recipient_inner ]		recipients : [ + COSE_recipient_inner ]
	]		]
			; Layer 2
	COSE_recipient_inner = [		COSE_recipient_inner = [
	protected : bstr .cbor header_map, ; must contain alg		protected : bstr .cbor header_map, ; must contain HPKE alg
	unprotected : header_map, ; must contain kid,		unprotected : header_map, ; must contain kid and ephemeral public key
	ciphertext : bstr ; CEK encrypted based on HPKE algo		empty : null,
	recipients : null		empty : null
	]		]
	header_map = {		header_map = {
	Generic_Headers,		Generic_Headers,
	* label =values,		* label =values,
	}		}
	Generic_Headers = (		Generic_Headers = (
	? 1 => int, ; algorithm identifier		? 1 => int, ; algorithm identifier
	? 2 => crv, ; EC identifier		? 2 => crv, ; EC identifier
	? 4 => bstr, ; key identifier		? 4 => bstr, ; key identifier
	? 5 => bstr ; IV		? 5 => bstr ; IV
	)		)
	Figure 5: CDDL for HPKE-based COSE_Encrypt Structure		Figure 7: CDDL for HPKE-based COSE_Encrypt Structure
	The COSE_Encrypt structure in Figure 5 requires the encrypted CEK and
	the ephemeral public key of the firmare author to be generated. This
	is accomplished with the HPKE encryption function as shown in
	Figure 6.
	CEK = random()
	pkR = DeserializePublicKey(recipient_public_key)
	info = "cose hpke" || 0x00 || COSE_KDF_Context
	enc, context = SetupBaseS(pkR, info)
	ciphertext = context.Seal(null, CEK)
	Figure 6
	Legend:
	- The functions DeserializePublicKey(), SetupBaseS() and Seal() are
	defined in HPKE [I-D.irtf-cfrg-hpke].
	- CEK is a random byte sequence of keysize length whereby keysize
	corresponds to the size of the indicated symmetric encryption
	algorithm used for firmware encryption. For example, AES-128-GCM
	requires a 16 byte key. The CEK would therefore be 16 bytes long.
	- 'recipient_public_key' represents the public key of the recipient.
	- 'info' is a data structure described below used as input to the
	key derivation internal to the HPKE algorithm. In addition to the
	constant prefix, the COSE_KDF_Context structure is used. The
	COSE_KDF_Context is shown in Figure 7.
	The result of the above-described operation is the encrypted CEK
	(denoted as ciphertext) and the enc - the HPKE encapsulated key (i.e.
	the ephemeral ECDH public key of the author).
	PartyInfo = (
	identity : bstr,
	nonce : nil,
	other : nil
	)
	COSE_KDF_Context = [
	AlgorithmID : int,
	PartyUInfo : [ PartyInfo ],
	PartyVInfo : [ PartyInfo ],
	SuppPubInfo : [
	keyDataLength : uint,
	protected : empty_or_serialized_map
	],
	]
	Figure 7: COSE_KDF_Context Data Structure
	Notes:
	- PartyUInfo.identity corresponds to the kid found in the
	COSE_Sign_Tagged or COSE_Sign1_Tagged structure (when a digital
	signature is used). When utilizing a MAC, then the kid is found
	in the COSE_Mac_Tagged or COSE_Mac0_Tagged structure.
	- PartyVInfo.identity corresponds to the kid used for the respective
	recipient from the inner-most recipients array.
	- The value in the AlgorithmID field corresponds to the alg
	parameter in the protected structure in the inner-most recipients
	array.
	- keyDataLength is set to the number of bits of the desired output
	value.
	- protected refers to the protected structure of the inner-most
	array.
	The author encrypts the firmware using the CEK with the selected
	algorithm.
	The recipient decrypts the encrypted CEK, using two input parameters:		The COSE_Encrypt structure (layer 0) contains algorithm parameters
			for encryption of the firmware image. The protected field MUST
			contain the 'alg' parameter and the unprotected field MUST contain
			the 'iv' parameter. The ciphertext is always detached.
	- the private key skR corresponding to the public key pkR used by		The COSE_recipient_outer structure (layer 1) contains the encrypted
	the author when creating the manifest.		CEK. The protected structure MUST be empty and the unprotected
			structure MUST contain the 'alg' parameter, which carries the
			algorithm information for protecting the CEK.
	- the HPKE encapsulated key (i.e. ephemeral ECDH public key) created		The COSE_recipient_inner structure (layer 2) contains the HPKE-
	by the author.		related information. The protected structure MUST contain the 'alg'
			parameter set to the algorithm values in Section 6 of [cose-hpke] and
			the unprotected structure MUST contain the 'kid' and the 'ephemeral'
			parameter.
	If the HPKE operation is successful, the recipient obtains the CEK		To populate the SUIT_Encryption_Info structure the sender creates a
	and can decrypt the firmware.		CEK randomly. The CEK is used to encrypt the firmware image with the
			selected algorithm.
	Figure 8 shows the HPKE computations performed by the recipient for		The HPKE SealBase function takes various input parameters, as
	decryption.		explained in [cose-hpke]. The most important input parameters are
			the plaintext (CEK in our case) and the public key of the recipient.
			If successful, SealBase will return the encrypted CEK and the
			ephemeral public key.
	info = "cose hpke" || 0x00 || COSE_KDF_Context		The recipient receives the ephemeral public key and the encrypted CEK
	context = SetupBaseR(ciphertext, skR, info)		from the sender. It then uses the HPKE OpenBase function to decrypt
	CEK = context.Open(null, ciphertext)		the ciphertext (which contains the CEK).
	Figure 8		If the HPKE OpenBase function is successful, the recipient obtains
			the CEK and can decrypt the firmware. The decryption operation is
			shown in Figure 4 of [cose-hpke].
	An example of the COSE_Encrypt structure using the HPKE scheme is		An example of the COSE_Encrypt structure using the HPKE scheme is
	shown in Figure 9. It uses the following algorithm combination:		shown in Figure 8. It uses the following algorithm combination:
	- AES-GCM-128 for encryption of the firmware image.		- AES-GCM-128 for encryption of the firmware image.
	- AES-GCM-128 for encrytion of the CEK.		- AES-GCM-128 for encrytion of the CEK.
	- Key Encapsulation Mechanism (KEM): NIST P-256		- Key Encapsulation Mechanism (KEM): NIST P-256
	- Key Derivation Function (KDF): HKDF-SHA256		- Key Derivation Function (KDF): HKDF-SHA256
	96(		96(
	skipping to change at page 14, line 41 ¶		skipping to change at page 15, line 37 ¶
	// kid for recipient static ECDH public key		// kid for recipient static ECDH public key
	4: h'6B69642D31'		4: h'6B69642D31'
	},		},
	// empty ciphertext		// empty ciphertext
	null		null
	]		]
	]		]
	]		]
	)		)
	Figure 9: COSE_Encrypt Example for HPKE		Figure 8: COSE_Encrypt Example for HPKE
	6. Complete Examples		7. CEK Verification
	TBD: Example for complete manifest here (which also includes the		The suit-cek-verification parameter contains a byte string resulting
	digital signature). TBD: Multiple recipient example as well. TBD:		from the encryption of 8 bytes of 0xA5 using the CEK.
	Encryption of manifest (in addition of firmware encryption).
	7. Security Considerations		[[Editor's Note: Guidance about the selection of an IV needs to be
			added here.]]
	The algorithms described in this document assume that the firmware		8. Complete Examples
	author
	- has either shared a key-encryption key (KEK) with the firmware		[[Editor's Note: Add examples for a complete manifest here (including
	consumer (for use with the AES-Key Wrap scheme), or		a digital signature), multiple recipients, encryption of manifests
			(in comparison to firmware images).]]
			9. Security Considerations
			The algorithms described in this document assume that the party
			performing the firmware encryption
			- shares a key-encryption key (KEK) with the firmware consumer (for
			use with the AES-Key Wrap scheme), or
	- is in possession of the public key of the firmware consumer (for		- is in possession of the public key of the firmware consumer (for
	use with HPKE).		use with HPKE).
	Both cases require some upfront communication interaction, which is		Both cases require some upfront communication interaction, which is
	not part of the SUIT manifest. This interaction is likely provided		not part of the SUIT manifest. This interaction is likely provided
	by an IoT device management solution, as described in [RFC9019].		by an IoT device management solution, as described in [RFC9019].
	For AES-Key Wrap to provide high security it is important that the		For AES-Key Wrap to provide high security it is important that the
	KEK is of high entropy, and that implementations protect the KEK from		KEK is of high entropy, and that implementations protect the KEK from
	skipping to change at page 15, line 37 ¶		skipping to change at page 16, line 37 ¶
	In some cases third party companies analyse binaries for known		In some cases third party companies analyse binaries for known
	security vulnerabilities. With encrypted firmware images this type		security vulnerabilities. With encrypted firmware images this type
	of analysis is prevented. Consequently, these third party companies		of analysis is prevented. Consequently, these third party companies
	either need to be given access to the plaintext binary before		either need to be given access to the plaintext binary before
	encryption or they need to become authorized recipients of the		encryption or they need to become authorized recipients of the
	encrypted firmware images. In either case, it is necessary to		encrypted firmware images. In either case, it is necessary to
	explicitly consider those third parties in the software supply chain		explicitly consider those third parties in the software supply chain
	when such a binary analysis is desired.		when such a binary analysis is desired.
	8. IANA Considerations		10. IANA Considerations
	This document requests IANA to create new entries in the COSE
	Algorithms registry established with [I-D.ietf-cose-rfc8152bis-algs].
	+-------------+-------+---------+------------+--------+---------------+		This document does not require any actions by IANA.
	| Name | Value | KDF | Ephemeral- | Key | Description |
	| | | | Static | Wrap | |
	+-------------+-------+---------+------------+--------+---------------+
	| HPKE/P-256+ | TBD1 | HKDF - | yes | none | HPKE with |
	| HKDF-256 | | SHA-256 | | | ECDH-ES |
	| | | | | | (P-256) + |
	| | | | | | HKDF-256 |
	+-------------+-------+---------+------------+--------+---------------+
	| HPKE/P-384+ | TBD2 | HKDF - | yes | none | HPKE with |
	| HKDF-SHA384 | | SHA-384 | | | ECDH-ES |
	| | | | | | (P-384) + |
	| | | | | | HKDF-384 |
	+-------------+-------+---------+------------+--------+---------------+
	| HPKE/P-521+ | TBD3 | HKDF - | yes | none | HPKE with |
	| HKDF-SHA521 | | SHA-521 | | | ECDH-ES |
	| | | | | | (P-521) + |
	| | | | | | HKDF-521 |
	+-------------+-------+---------+------------+--------+---------------+
	| HPKE | TBD4 | HKDF - | yes | none | HPKE with |
	| X25519 + | | SHA-256 | | | ECDH-ES |
	| HKDF-SHA256 | | | | | (X25519) + |
	| | | | | | HKDF-256 |
	+-------------+-------+---------+------------+--------+---------------+
	| HPKE | TBD4 | HKDF - | yes | none | HPKE with |
	| X448 + | | SHA-512 | | | ECDH-ES |
	| HKDF-SHA512 | | | | | (X448) + |
	| | | | | | HKDF-512 |
	+-------------+-------+---------+------------+--------+---------------+
	9. References		11. References
	9.1. Normative References		11.1. Normative References
	[I-D.ietf-cose-rfc8152bis-algs]		[cose-hpke]
	Schaad, J., "CBOR Object Signing and Encryption (COSE):		Tschofenig, H., Housley, R., and B. Moran, "Use of Hybrid
	Initial Algorithms", draft-ietf-cose-rfc8152bis-algs-12		Public-Key Encryption (HPKE) with CBOR Object Signing and
	(work in progress), September 2020.		Encryption (COSE)", October 2021,
			<https://datatracker.ietf.org/doc/html/
			draft-tschofenig-cose-hpke-00>.
	[I-D.ietf-suit-manifest]		[I-D.ietf-suit-manifest]
	Moran, B., Tschofenig, H., Birkholz, H., and K. Zandberg,		Arm Limited, Arm Limited, Fraunhofer SIT, and Inria, "A
	"A Concise Binary Object Representation (CBOR)-based		Concise Binary Object Representation (CBOR)-based
	Serialization Format for the Software Updates for Internet		Serialization Format for the Software Updates for Internet
	of Things (SUIT) Manifest", draft-ietf-suit-manifest-12		of Things (SUIT) Manifest", draft-ietf-suit-manifest-14
	(work in progress), February 2021.		(work in progress), July 2021.
	[I-D.irtf-cfrg-hpke]		[I-D.irtf-cfrg-hpke]
	Barnes, R. L., Bhargavan, K., Lipp, B., and C. A. Wood,		Cisco, Inria, Inria, and Cloudflare, "Hybrid Public Key
	"Hybrid Public Key Encryption", draft-irtf-cfrg-hpke-08		Encryption", draft-irtf-cfrg-hpke-12 (work in progress),
	(work in progress), February 2021.		September 2021.
	[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate		[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
	Requirement Levels", BCP 14, RFC 2119,		Requirement Levels", BCP 14, RFC 2119,
	DOI 10.17487/RFC2119, March 1997,		DOI 10.17487/RFC2119, March 1997,
	<https://www.rfc-editor.org/info/rfc2119>.		<https://www.rfc-editor.org/info/rfc2119>.
	[RFC3394] Schaad, J. and R. Housley, "Advanced Encryption Standard		[RFC3394] Schaad, J. and R. Housley, "Advanced Encryption Standard
	(AES) Key Wrap Algorithm", RFC 3394, DOI 10.17487/RFC3394,		(AES) Key Wrap Algorithm", RFC 3394, DOI 10.17487/RFC3394,
	September 2002, <https://www.rfc-editor.org/info/rfc3394>.		September 2002, <https://www.rfc-editor.org/info/rfc3394>.
	[RFC8152] Schaad, J., "CBOR Object Signing and Encryption (COSE)",		[RFC8152] Schaad, J., "CBOR Object Signing and Encryption (COSE)",
	RFC 8152, DOI 10.17487/RFC8152, July 2017,		RFC 8152, DOI 10.17487/RFC8152, July 2017,
	<https://www.rfc-editor.org/info/rfc8152>.		<https://www.rfc-editor.org/info/rfc8152>.
	[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC		[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
	2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,		2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
	May 2017, <https://www.rfc-editor.org/info/rfc8174>.		May 2017, <https://www.rfc-editor.org/info/rfc8174>.
	9.2. Informative References		11.2. Informative References
	[I-D.ietf-suit-information-model]		[I-D.ietf-suit-information-model]
	Moran, B., Tschofenig, H., and H. Birkholz, "A Manifest		Arm Limited, Arm Limited, and Fraunhofer SIT, "A Manifest
	Information Model for Firmware Updates in IoT Devices",		Information Model for Firmware Updates in IoT Devices",
	draft-ietf-suit-information-model-11 (work in progress),		draft-ietf-suit-information-model-13 (work in progress),
	April 2021.		July 2021.
	[RFC2630] Housley, R., "Cryptographic Message Syntax", RFC 2630,		[RFC2630] Housley, R., "Cryptographic Message Syntax", RFC 2630,
	DOI 10.17487/RFC2630, June 1999,		DOI 10.17487/RFC2630, June 1999,
	<https://www.rfc-editor.org/info/rfc2630>.		<https://www.rfc-editor.org/info/rfc2630>.
	[RFC4949] Shirey, R., "Internet Security Glossary, Version 2",		[RFC4949] Shirey, R., "Internet Security Glossary, Version 2",
	FYI 36, RFC 4949, DOI 10.17487/RFC4949, August 2007,		FYI 36, RFC 4949, DOI 10.17487/RFC4949, August 2007,
	<https://www.rfc-editor.org/info/rfc4949>.		<https://www.rfc-editor.org/info/rfc4949>.
	[RFC8937] Cremers, C., Garratt, L., Smyshlyaev, S., Sullivan, N.,		[RFC8937] Cremers, C., Garratt, L., Smyshlyaev, S., Sullivan, N.,
End of changes. 73 change blocks.
	268 lines changed or deleted		296 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/