Internet-Draft Firmware Encryption July 2021
Tschofenig, et al. Expires 13 January 2022 [Page]
Intended Status:
Standards Track
H. Tschofenig
Arm Limited
R. Housley
Vigil Security
B. Moran
Arm Limited

Firmware Encryption with SUIT Manifests


This document specifies a firmware update mechanism where the firmware image is encrypted. This mechanism uses the IETF SUIT manifest with key establishment provided by the hybrid public-key encryption (HPKE) scheme or AES Key Wrap (AES-KW) with a pre-shared key-encryption key. In either case, AES-GCM or AES-CCM is used for firmware encryption.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on 13 January 2022.

Table of Contents

1. Introduction

Vulnerabilities with Internet of Things (IoT) devices have raised the need for a reliable and secure firmware update mechanism that is also suitable for constrained devices. To protect firmware images the SUIT manifest format was developed [I-D.ietf-suit-manifest]. The SUIT manifest provides a bundle of metadata about the firmware for an IoT device, where to find the firmware image, and the devices to which it applies.

The SUIT information model [I-D.ietf-suit-information-model] details the information that has to be offered by the SUIT manifest format. In addition to offering protection against modification, which is provided by a digital signature or a message authentication code, the firmware image may also be afforded confidentiality using encryption.

Encryption prevents third parties, including attackers, from gaining access to the firmware image. For example, return-oriented programming (ROP) requires intimate knowledge of the target firmware and encryption makes this approach much more difficult to exploit. The SUIT manifest provides the data needed for authorized recipients of the firmware image to decrypt it.

A symmetric cryptographic key is established for encryption and decryption, and that key can be applied to a SUIT manifest, firmware images, or personalization data, depending on the encryption choices of the firmware author. This symmetric key can be established using a variety of mechanisms; this document defines two approaches for use with the IETF SUIT manifest. Key establishment can be provided by the hybrid public-key encryption (HPKE) scheme or AES Key Wrap (AES-KW) with a pre-shared key-encryption key. These choices reduce the number of possible key establishment options and thereby help increase interoperability between different SUIT manifest parser implementations.

The document also contains a number of examples for developers.

2. Conventions and Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.

This document assumes familiarity with the IETF SUIT manifest [I-D.ietf-suit-manifest] and the SUIT architecture [RFC9019].

In context of encryption, the terms "recipient" and "firmware consumer" are used interchangeably.

Additionally, the following abbreviations are used in this document:

3. Architecture

Figure 1 in [RFC9019] shows the architecture for distributing firmware images and manifests from the author to the firmware consumer. It does, however, not detail the use of encrypted firmware images. Figure 1 therefore focuses on those aspects. The firmware server and the device management infrastructure is represented by the distribution system, which is aware of the individual devices a firmware update has to be delivered to.

Firmware encryption requires the party doing the encryption to know either the KEK (in case of AES-KW) or the public key of the recipient (in case of HPKE). The firmware author may have knowledge about all the devices but in most cases this will not be likely. Hence, it is the responsibility of the distribution system to perform the firmware encryption.

Since including the COSE_Encrypt structure in the manifest invalidates a a digital signature or a MAC added by the author, this structure needs to be added to the envelope by the distribution system. This approach offers flexiblity when the number of devices that need to receive encrypted firmware images changes dynamically or when the updates to KEKs or recipient public keys are necessary. As a downside, the author needs to trust the distribution system with performing the encryption of the plaintext firmware image.

                                           |          |
                                           |  Author  |
                                           |          |
 +----------+                              +----------+
 |          |                                   |
 |  Device  |---+                               | Firmware +
 |          |   |                               | Manifest
 +----------+   |                               |
                |                               |
                |                        +--------------+
 +----------+   |                        |              |
 |          |   |  Firmware + Manifest   | Distribution |
 |  Device  |---+------------------------|    System    |
 |          |   |                        |              |
 +----------+   |                        +--------------+
 +----------+   |
 |          |   |
 |  Device  +---+
 |          |
Figure 1: Firmware Encryption Architecture.

4. AES Key Wrap

The AES Key Wrap (AES-KW) algorithm is described in RFC 3394 [RFC3394], and it can be used to encrypt a randomly generated content-encryption key (CEK) with a pre-shared key-encryption key (KEK). The COSE conventions for using AES-KW are specified in Section 12.2.1 of [RFC8152]. The encrypted CEK is carried in the COSE_recipient structure alongside the information needed for AES-KW. The COSE_recipient structure, which is a substructure of the COSE_Encrypt structure, contains the CEK encrypted by the KEK.

When the firmware image is encrypted for use by multiple recipients, there are three options:

Note that the AES-KW algorithm, as defined in Section of [RFC3394], does not have public parameters that vary on a per-invocation basis. Hence, the protected structure in the COSE_recipient is a byte string of zero length.

The COSE_Encrypt conveys information for encrypting the firmware image, which includes information like the algorithm and the IV, even though the firmware image is not embedded in the COSE_Encrypt.ciphertext itself since it conveyed as detached content.

The CDDL for the COSE_Encrypt_Tagged structure is shown in Figure 2.

COSE_Encrypt_Tagged = #6.96(COSE_Encrypt)

SUIT_Encryption_Info = COSE_Encrypt_Tagged

COSE_Encrypt = [
  protected   : bstr .cbor outer_header_map_protected,
  unprotected : outer_header_map_unprotected,
  ciphertext  : null,                  ; because of detached ciphertext
  recipients  : [ + COSE_recipient ]

outer_header_map_protected =
    1 => int,         ; algorithm identifier
  * label =values     ; extension point

outer_header_map_unprotected =
    5 => bstr,        ; IV
  * label =values     ; extension point

COSE_recipient = [
  protected   : bstr .size 0,
  unprotected : recipient_header_map,
  ciphertext  : bstr        ; CEK encrypted with KEK

recipient_header_map =
    1 => int,         ; algorithm identifier
    4 => bstr,        ; key identifier
  * label =values     ; extension point
Figure 2: CDDL for AES Key Wrap-based Firmware Encryption

The COSE specification requires a consistent byte stream for the authenticated data structure to be created, which is shown in Figure 3.

       Enc_structure = [
         context : "Encrypt",
         protected : empty_or_serialized_map,
         external_aad : bstr
Figure 3: CDDL for Enc_structure Data Structure

As shown in Figure 2, there are two protected fields: one protected field in the COSE_Encrypt structure and a second one in the COSE_recipient structure. The 'protected' field in the Enc_structure, see Figure 3, refers to the content of the protected field from the COSE_Encrypt structure, not to the protected field of the COSE_recipient structure.

The value of the external_aad is set to null.

The following example illustrates the use of the AES-KW algorithm with AES-128.

We use the following parameters in this example:

The COSE_Encrypt structure in hex format is (with a line break inserted):


The resulting COSE_Encrypt structure in a dignostic format is shown in Figure 4.

        // protected field with alg=AES-GCM-128
           // unprotected field with iv
           5: h'26682306D4FB28CA01B43B80'
        // null because of detached ciphertext
        [ // recipients array
           h'', // protected field
           {    // unprotected field
              1: -3,            // alg=A128KW
              4: h'6B69642D31'  // key id
           // CEK encrypted with KEK
Figure 4: COSE_Encrypt Example for AES Key Wrap

The CEK was "4C805F1587D624ED5E0DBB7A7F7FA7EB" and the encrypted firmware was:


5. Hybrid Public-Key Encryption (HPKE)

Hybrid public-key encryption (HPKE) [I-D.irtf-cfrg-hpke] is a scheme that provides public key encryption of arbitrary-sized plaintexts given a recipient's public key.

For use with firmware encryption the scheme works as follows: The firmware author uses HPKE, which internally utilizes a non-interactive ephemeral-static Diffie-Hellman exchange to derive a shared secret, which is then used to encrypt plaintext.

In the firmware encryption scenario, the plaintext passed to HPKE for encryption is the randomly generated CEK. The output of the HPKE operation is therefore the encrypted CEK along with HPKE encapsulated key (i.e. the ephemeral ECDH public key of the author). The CEK is then used to encrypt the firmware.

Only the holder of recipient's private key can decapsulate the CEK to decrypt the firmware. Key generation is influced by additional parameters, such as identity information.

This approach allows all recipients to use the same CEK to encrypt the firmware image, in case there are multiple recipients, to fulfill a requirement for the efficient distribution of firmware images using a multicast or broadcast protocol.

The CDDL for the COSE_Encrypt structure as used with HPKE is shown in Figure 5.

COSE_Encrypt_Tagged = #6.96(COSE_Encrypt)

SUIT_Encryption_Info = COSE_Encrypt_Tagged

COSE_Encrypt = [
  protected   : bstr .cbor header_map, ; must contain alg
  unprotected : header_map,            ; must contain iv
  ciphertext  : null,                  ; because of detached ciphertext
  recipients  : [ + COSE_recipient_outer ]

COSE_recipient_outer = [
  protected   : bstr .size 0,
  unprotected : header_map, ; must contain alg
  ciphertext  : bstr        ; CEK encrypted based on HPKE algo
  recipients  : [ + COSE_recipient_inner ]

COSE_recipient_inner = [
  protected   : bstr .cbor header_map, ; must contain alg
  unprotected : header_map, ; must contain kid,
  ciphertext  : bstr        ; CEK encrypted based on HPKE algo
  recipients  : null

header_map = {
  * label =values,

Generic_Headers = (
    ? 1 => int,         ; algorithm identifier
    ? 2 => crv,         ; EC identifier
    ? 4 => bstr,        ; key identifier
    ? 5 => bstr         ; IV
Figure 5: CDDL for HPKE-based COSE_Encrypt Structure

The COSE_Encrypt structure in Figure 5 requires the encrypted CEK and the ephemeral public key of the firmare author to be generated. This is accomplished with the HPKE encryption function as shown in Figure 6.

    CEK = random()
    pkR = DeserializePublicKey(recipient_public_key)
    info = "cose hpke" || 0x00 || COSE_KDF_Context
    enc, context = SetupBaseS(pkR, info)
    ciphertext = context.Seal(null, CEK)
Figure 6


The result of the above-described operation is the encrypted CEK (denoted as ciphertext) and the enc - the HPKE encapsulated key (i.e. the ephemeral ECDH public key of the author).

PartyInfo = (
   identity : bstr,
   nonce : nil,
   other : nil

COSE_KDF_Context = [
   AlgorithmID : int,
   PartyUInfo : [ PartyInfo ],
   PartyVInfo : [ PartyInfo ],
   SuppPubInfo : [
       keyDataLength : uint,
       protected : empty_or_serialized_map
Figure 7: COSE_KDF_Context Data Structure


The author encrypts the firmware using the CEK with the selected algorithm.

The recipient decrypts the encrypted CEK, using two input parameters:

If the HPKE operation is successful, the recipient obtains the CEK and can decrypt the firmware.

Figure 8 shows the HPKE computations performed by the recipient for decryption.

    info = "cose hpke" || 0x00 || COSE_KDF_Context
    context = SetupBaseR(ciphertext, skR, info)
    CEK = context.Open(null, ciphertext)
Figure 8

An example of the COSE_Encrypt structure using the HPKE scheme is shown in Figure 9. It uses the following algorithm combination:

        // protected field with alg=AES-GCM-128
        {    // unprotected field with iv
             5: h'26682306D4FB28CA01B43B80'
        // null because of detached ciphertext
        [  // COSE_recipient_outer
            h'',          // empty protected field
            {             // unprotected field with ...
                 1: 1     //     alg=A128GCM
            // Encrypted CEK
            [    // COSE_recipient_inner
                 // protected field with alg HPKE/P-256+HKDF-256 (new)
                 {  // unprotected field with ...
                    //    HPKE encapsulated key
                    -1: h'A4010220012158205F...979D51687187510C445’,
                    //    kid for recipient static ECDH public key
                     4: h'6B69642D31'
                 // empty ciphertext
Figure 9: COSE_Encrypt Example for HPKE

6. Complete Examples

TBD: Example for complete manifest here (which also includes the digital signature). TBD: Multiple recipient example as well. TBD: Encryption of manifest (in addition of firmware encryption).

7. Security Considerations

The algorithms described in this document assume that the firmware author

Both cases require some upfront communication interaction, which is not part of the SUIT manifest. This interaction is likely provided by an IoT device management solution, as described in [RFC9019].

For AES-Key Wrap to provide high security it is important that the KEK is of high entropy, and that implementations protect the KEK from disclosure. Compromise of the KEK may result in the disclosure of all key data protected with that KEK.

Since the CEK is randomly generated, it must be ensured that the guidelines for random number generations are followed, see [RFC8937].

In some cases third party companies analyse binaries for known security vulnerabilities. With encrypted firmware images this type of analysis is prevented. Consequently, these third party companies either need to be given access to the plaintext binary before encryption or they need to become authorized recipients of the encrypted firmware images. In either case, it is necessary to explicitly consider those third parties in the software supply chain when such a binary analysis is desired.

8. IANA Considerations

This document requests IANA to create new entries in the COSE Algorithms registry established with [I-D.ietf-cose-rfc8152bis-algs].

| Name        | Value | KDF     | Ephemeral- | Key    | Description   |
|             |       |         | Static     | Wrap   |               |
| HPKE/P-256+ | TBD1  | HKDF -  | yes        | none   | HPKE with     |
| HKDF-256    |       | SHA-256 |            |        | ECDH-ES       |
|             |       |         |            |        | (P-256) +     |
|             |       |         |            |        | HKDF-256      |
| HPKE/P-384+ | TBD2  | HKDF -  | yes        | none   | HPKE with     |
| HKDF-SHA384 |       | SHA-384 |            |        | ECDH-ES       |
|             |       |         |            |        | (P-384) +     |
|             |       |         |            |        | HKDF-384      |
| HPKE/P-521+ | TBD3  | HKDF -  | yes        | none   | HPKE with     |
| HKDF-SHA521 |       | SHA-521 |            |        | ECDH-ES       |
|             |       |         |            |        | (P-521) +     |
|             |       |         |            |        | HKDF-521      |
| HPKE        | TBD4  | HKDF -  | yes        | none   | HPKE with     |
| X25519 +    |       | SHA-256 |            |        | ECDH-ES       |
| HKDF-SHA256 |       |         |            |        | (X25519) +    |
|             |       |         |            |        | HKDF-256      |
| HPKE        | TBD4  | HKDF -  | yes        | none   | HPKE with     |
| X448 +      |       | SHA-512 |            |        | ECDH-ES       |
| HKDF-SHA512 |       |         |            |        | (X448) +      |
|             |       |         |            |        | HKDF-512      |

9. References

9.1. Normative References

Schaad, J., "CBOR Object Signing and Encryption (COSE): Initial Algorithms", Work in Progress, Internet-Draft, draft-ietf-cose-rfc8152bis-algs-12, , <>.
Moran, B., Tschofenig, H., Birkholz, H., and K. Zandberg, "A Concise Binary Object Representation (CBOR)-based Serialization Format for the Software Updates for Internet of Things (SUIT) Manifest", Work in Progress, Internet-Draft, draft-ietf-suit-manifest-12, , <>.
Barnes, R. L., Bhargavan, K., Lipp, B., and C. A. Wood, "Hybrid Public Key Encryption", Work in Progress, Internet-Draft, draft-irtf-cfrg-hpke-08, , <>.
Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, , <>.
Schaad, J. and R. Housley, "Advanced Encryption Standard (AES) Key Wrap Algorithm", RFC 3394, DOI 10.17487/RFC3394, , <>.
Schaad, J., "CBOR Object Signing and Encryption (COSE)", RFC 8152, DOI 10.17487/RFC8152, , <>.
Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, , <>.

9.2. Informative References

Moran, B., Tschofenig, H., and H. Birkholz, "A Manifest Information Model for Firmware Updates in IoT Devices", Work in Progress, Internet-Draft, draft-ietf-suit-information-model-11, , <>.
Housley, R., "Cryptographic Message Syntax", RFC 2630, DOI 10.17487/RFC2630, , <>.
Shirey, R., "Internet Security Glossary, Version 2", FYI 36, RFC 4949, DOI 10.17487/RFC4949, , <>.
Cremers, C., Garratt, L., Smyshlyaev, S., Sullivan, N., and C. Wood, "Randomness Improvements for Security Protocols", RFC 8937, DOI 10.17487/RFC8937, , <>.
Moran, B., Tschofenig, H., Brown, D., and M. Meriac, "A Firmware Update Architecture for Internet of Things", RFC 9019, DOI 10.17487/RFC9019, , <>.

Appendix A. Acknowledgements

We would like to thank Henk Birkholz for his feedback on the CDDL description in this document. Additionally, we would like to thank Michael Richardson and Carsten Bormann for their review feedback. Finally, we would like to thank Dick Brooks for making us aware of the challenges firmware encryption imposes on binary analysis.

Authors' Addresses

Hannes Tschofenig
Arm Limited
Russ Housley
Vigil Security, LLC
Brendan Moran
Arm Limited