Firmware Encryption with SUIT ManifestsArm Limitedhannes.tschofenig@arm.comVigil Security, LLChousley@vigilsec.comArm LimitedBrendan.Moran@arm.com
Security
SUITInternet-DraftThis document specifies a firmware update mechanism where the
firmware image is encrypted. This mechanism uses the IETF
SUIT manifest with key establishment provided by the hybrid
public-key encryption (HPKE) scheme or AES Key Wrap (AES-KW) with
a pre-shared key-encryption key. In either case, AES-GCM or
AES-CCM is used for firmware encryption.Vulnerabilities with Internet of Things (IoT) devices have raised the
need for a reliable and secure firmware update mechanism that is also
suitable for constrained devices. To protect firmware images the SUIT manifest
format was developed . The SUIT manifest provides a
bundle of metadata about the firmware for an IoT device, where to find
the firmware image, and the devices to which it applies.The SUIT information model details the
information that has to be offered by the SUIT manifest format. In addition to
offering protection against modification, which is provided by a digital
signature or a message authentication code, the firmware image may also be
confidentiality protected using encryption.Encryption prevents third parties, including attackers, from gaining access to
the firmware image. This might be done to protect confidential information
or prevent discovery of vulnerabilities through reverse engineering. The SUIT
manifest provides the data needed for authorized recipients of the firmware
image to decrypt it.A symmetric cryptographic key is established for encryption and decryption, and
that key can be applied to a SUIT manifest, firmware images, or personalization
data, depending on the encryption choices of the firmware author. This symmetric key
can be established using a variety of mechanisms; this document defines two
approaches for use with the IETF SUIT manifest. Key establishment can be
provided by the hybrid public-key encryption (HPKE) scheme or AES Key Wrap
(AES-KW) with a pre-shared key-encryption key. These choices reduce the
number of possible key establishment options for interoperability of
different SUIT manifest implementations. The document also offers a
number of examples for developers.The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”,
“SHOULD NOT”, “RECOMMENDED”, “NOT RECOMMENDED”, “MAY”, and “OPTIONAL” in this
document are to be interpreted as described in BCP 14
when, and only when, they appear in all capitals, as shown here.This document assumes familiarity with the IETF SUIT manifest
and the SUIT architecture .The terms “recipient” and “firmware consumer” are used interchangeably.The AES Key Wrap (AES-KW) algorithm is described in RFC 3394 , and
it can be used to encrypt a randomly generated content-encryption key (CEK)
with a pre-shared key-encryption key (KEK). The COSE conventions for using
AES-KW are specified in Section 12.2.1 of . The encrypted CEK is
carried in the COSE_recipient structure alongside the information needed for
AES-KW. The COSE_recipient structure, which is a substructure of the COSE_Encrypt,
contains the CEK encrypted by the KEK. When the firmware image is encrypted
for use by multiple recipients, the COSE_recipient structure will contain
one encrypted CEK if all of the authorized recipients have access to the KEK.However, the COSE_recipient structure can contain the same CEK encrypted
with many different KEKs if needed to reach all of the authorized recipients.Note that the AES-KW algorithm, as defined in Section 2.2.3.1 of ,
does not have public parameters that vary on a per-invocation basis. Hence,
the protected structure in the COSE_recipient is a byte string of zero length.The COSE_Encrypt conveys information for encrypting the firmware image,
which includes information like the algorithm and the IV, even though the
firmware image is not embedded in the COSE_Encrypt.ciphertext itself since
it conveyed as detached content.The CDDL for the COSE_Encrypt_Tagged structure is shown in .The COSE specification requires a consistent byte stream for the
authenticated data structure to be created, which is defined as
shown in .As it can be seen in the CDDL in , there are two protected fields
and the ‘protected’ field in the Enc_structure, see ,
refers to the outer protected field, not the protected field of the
COSE_recipient structure.The value of the external_aad is set to null.The following example illustrates the use of the AES-KW algorithm with AES-128.We use the following parameters in this example:IV: 0x26, 0x68, 0x23, 0x06, 0xd4, 0xfb, 0x28, 0xca, 0x01, 0xb4, 0x3b, 0x80KEK: “aaaaaaaaaaaaaaaa”KID: “kid-1”Plaintext Firmware: “This is a real firmware image.”Firmware (hex): 546869732069732061207265616C206669726D7761726520696D6167652EThe COSE_Encrypt structure in hex format is (with a line break inserted):The resulting COSE_Encrypt structure in a dignostic format is shown in .The CEK was “4C805F1587D624ED5E0DBB7A7F7FA7EB” and the encrypted firmware was:Hybrid public-key encryption (HPKE) is a scheme that provides
public key encryption of arbitrary-sized plaintexts given a recipient’s public key.For use with firmware encryption the scheme works as follows: The firmware author uses
HPKE, which internally utilizes a non-interactive ephemeral-static Diffie-Hellman exchange to
derive a shared secret, which is then used to encrypt plaintext. In the firmware
encryption scenario, the plaintext passed to HPKE for encryption is a randomly
generated CEK. The output of the HPKE operation is therefore the encrypted CEK along
with HPKE encapsulated key (i.e. the ephemeral ECDH public key of the author).
The CEK is then used to encrypt the firmware.Only the holder of recipient’s private key can decapsulate the CEK to decrypt the
firmware. Key generation is influced by additional parameters, such as
identity information.This approach allows us to have all recipients to use the same CEK to encrypt the
firmware image, in case there are multiple recipients, to fulfill a requirement for
the efficient distribution of firmware images using a multicast or broadcast protocol.The CDDL for the COSE_Encrypt structure as used with HPKE is shown in .The COSE_Encrypt structure in requires the
encrypted CEK and the ephemeral public key of the firmare author to be
generated. This is accomplished with the HPKE encryption function as shown here:Legend:The functions DeserializePublicKey(), SetupBaseS() and Seal() are defined in
HPKE .CEK is a random byte sequence of keysize length whereby keysize corresponds to the size
of the indicated symmetric encryption algorithm used for firmware encryption. For example,
AES-128-GCM requires a 16 byte key. The CEK would therefore be 16 bytes long.‘recipient_public_key’ represents the public key of the recipient.‘info’ is a data structure described below used as input to the key derivation internal to the HPKE
algorithm. In addition to the constant prefix, the COSE_KDF_Context structure is used. The COSE_KDF_Context is shown in .The result of the above-described operation is the encrypted CEK (denoted as ciphertext) and
the enc - the HPKE encapsulated key (i.e. the ephemeral ECDH public key of the author).Notes:PartyUInfo.identity corresponds to the kid found in the COSE_Sign_Tagged or
COSE_Sign1_Tagged structure (when a digital signature is used. When utilizing a MAC,
then the kid is found in the COSE_Mac_Tagged or COSE_Mac0_Tagged structure.PartyVInfo.identity corresponds to the kid used for the respective recipient from the
inner-most recipients array.The value in the AlgorithmID field corresponds to the alg parameter in the protected
structure in the inner-most recipients array.keyDataLength is set to the number of bits of the desired output value.protected refers to the protected structure of the inner-most array.The author encrypts the firmware using the CEK with the selected algorithm.The recipient decrypts the received ciphertext, i.e. the encrypted CEK, using two
input parameters:the private key skR corresponding to the public key pkR used by the author when creating
the manifest.the HPKE encapsulated key (i.e. ephemeral ECDH public key) created by the author.If the HPKE operation is successful, the recipient obtains the CEK and can decrypt the
firmware.The following text shows the HPKE operations performed by the recipient:An example of the COSE_Encrypt structure using the HPKE scheme is
shown in .TBD: Add example for complete manifest here (which also includes the digital signature).
TBD: Add multiple recipient example as well.
TBD: Add encryption of manifest (in addition of firmware encryption).This entire document is about security.The algorithms described in this document assume that the firmware authorhas either shared a key-encryption key (KEK) with the firmware consumer (for use with the AES-Key Wrap scheme), oris in possession of the public key of the firmware consumer (for use with HPKE).Both cases require some upfront communication interaction, which is not part of the SUIT manifest.This document requests IANA to create new entries in the COSE Algorithms
registry established with .A Concise Binary Object Representation (CBOR)-based Serialization Format for the Software Updates for Internet of Things (SUIT) ManifestArm LimitedArm LimitedFraunhofer SITInria This specification describes the format of a manifest. A manifest is
a bundle of metadata about code/data obtained by a recipient (chiefly
the firmware for an IoT device), where to find the that code/data,
the devices to which it applies, and cryptographic information
protecting the manifest. Software updates and Trusted Invocation
both tend to use sequences of common operations, so the manifest
encodes those sequences of operations, rather than declaring the
metadata.
Key words for use in RFCs to Indicate Requirement LevelsIn many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.Advanced Encryption Standard (AES) Key Wrap AlgorithmCBOR Object Signing and Encryption (COSE)Concise Binary Object Representation (CBOR) is a data format designed for small code size and small message size. There is a need for the ability to have basic security services defined for this data format. This document defines the CBOR Object Signing and Encryption (COSE) protocol. This specification describes how to create and process signatures, message authentication codes, and encryption using CBOR for serialization. This specification additionally describes how to represent cryptographic keys using CBOR.Ambiguity of Uppercase vs Lowercase in RFC 2119 Key WordsRFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings.Hybrid Public Key EncryptionCiscoInriaInriaCloudflare This document describes a scheme for hybrid public-key encryption
(HPKE). This scheme provides authenticated public key encryption of
arbitrary-sized plaintexts for a recipient public key. HPKE works
for any combination of an asymmetric key encapsulation mechanism
(KEM), key derivation function (KDF), and authenticated encryption
with additional data (AEAD) encryption function. We provide
instantiations of the scheme using widely used and efficient
primitives, such as Elliptic Curve Diffie-Hellman key agreement,
HKDF, and SHA2.
This document is a product of the Crypto Forum Research Group (CFRG)
in the IRTF.
CBOR Object Signing and Encryption (COSE): Initial AlgorithmsAugust Cellars Concise Binary Object Representation (CBOR) is a data format designed
for small code size and small message size. There is a need for the
ability to have basic security services defined for this data format.
THis document defines a set of algorithms that can be used with the
CBOR Object Signing and Encryption (COSE) protocol RFC XXXX.
A Firmware Update Architecture for Internet of ThingsVulnerabilities in Internet of Things (IoT) devices have raised the need for a reliable and secure firmware update mechanism suitable for devices with resource constraints. Incorporating such an update mechanism is a fundamental requirement for fixing vulnerabilities, but it also enables other important capabilities such as updating configuration settings and adding new functionality.In addition to the definition of terminology and an architecture, this document provides the motivation for the standardization of a manifest format as a transport-agnostic means for describing and protecting firmware updates.A Manifest Information Model for Firmware Updates in IoT DevicesArm LimitedArm LimitedFraunhofer SIT Vulnerabilities with Internet of Things (IoT) devices have raised the
need for a reliable and secure firmware update mechanism that is also
suitable for constrained devices. Ensuring that devices function and
remain secure over their service life requires such an update
mechanism to fix vulnerabilities, to update configuration settings,
as well as adding new functionality.
One component of such a firmware update is a concise and machine-
processable meta-data document, or manifest, that describes the
firmware image(s) and offers appropriate protection. This document
describes the information that must be present in the manifest.
We would like to thank Henk Birkholz for his feedback on the CDDL description in this document.