Internet-Draft Encrypted Payloads in SUIT Manifests March 2023
Tschofenig, et al. Expires 14 September 2023 [Page]
Workgroup:
SUIT
Internet-Draft:
draft-ietf-suit-firmware-encryption-10
Published:
Intended Status:
Standards Track
Expires:
Authors:
H. Tschofenig
R. Housley
Vigil Security
B. Moran
Arm Limited
D. Brown
Linaro
K. Takayama
SECOM CO., LTD.

Encrypted Payloads in SUIT Manifests

Abstract

This document specifies techniques for encrypting software, firmware and personalization data by utilizing the IETF SUIT manifest. Key agreement is provided by ephemeral-static (ES) Diffie-Hellman (DH) and AES Key Wrap (AES-KW). ES-DH uses public key cryptography while AES-KW uses a pre-shared key-encryption key. Encryption of the plaintext is accomplished with conventional symmetric key cryptography.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on 14 September 2023.

▲

Table of Contents

1. Introduction

Vulnerabilities with Internet of Things (IoT) devices have raised the need for a reliable and secure firmware update mechanism that is also suitable for constrained devices. To protect firmware images the SUIT manifest format was developed [I-D.ietf-suit-manifest]. The SUIT manifest provides a bundle of metadata about the firmware for an IoT device, where to find the firmware image, and the devices to which it applies.

The SUIT information model [RFC9124] details the information that has to be offered by the SUIT manifest format. In addition to offering protection against modification, which is provided by a digital signature or a message authentication code, the firmware image may also be afforded confidentiality using encryption.

Encryption prevents third parties, including attackers, from gaining access to the firmware binary. Hackers typically need intimate knowledge of the target firmware to mount their attacks. For example, return-oriented programming (ROP) [ROP] requires access to the binary and encryption makes it much more difficult to write exploits.

The SUIT manifest provides the data needed for authorized recipients of the firmware image to decrypt it. The firmware image is encrypted using a symmetric key.

A symmetric key can be established using a variety of mechanisms; this document defines two approaches for use with the IETF SUIT manifest, namely:

OPEN ISSUE: Should KEM algorithms also be supported?

These choices reduce the number of possible key establishment options and thereby help increase interoperability between different SUIT manifest parser implementations.

While the original motivating use case of this document was firmware encryption, SUIT manifests may require payloads other than firmware images to experience confidentiality protection, such as - software packages, - personalization data, - configuration data, and - machine learning models.

Hence, the term payload is used to generically refer to those objects that may be subject to encryption.

2. Conventions and Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.

This document assumes familiarity with the IETF SUIT manifest [I-D.ietf-suit-manifest], the SUIT information model [RFC9124] and the SUIT architecture [RFC9019].

The terms sender and recipient have the following meaning:

Additionally, the following abbreviations are used in this document:

3. Architecture

[RFC9019] describes the architecture for distributing payloads and manifests from an author to devices. It does, however, not detail the use of payload encryption.

This document enhances this architecture to support encryption. The author and the distribution system are logical roles. In some deployments these roles are separated in different physical entities and in others they are co-located.

Figure 1 shows the distribution system, which represents the firmware server and the device management infrastructure. The distribution system is aware of the individual devices to which a payload has to be delivered. The author is typically unaware which devices need to receive these payloads.

To apply encryption the sender needs to know the recipient. For AES-KW the KEK needs to be known and, in case of ES-DH, the sender needs to be in possession of the public key of the recipient. The DH public key and parameters may be in the recipient's X.509 certificate [RFC5280].

If the author delegates the task of identifying the recipients of the payloads to the distribution system, it needs to trust it with the appropriate protection of the plaintext firmware image before encryption is performed.

                                           +----------+
                                           |          |
                                           |  Author  |
                                           |          |
 +----------+                              +----------+
 |  Device  |---+                               |
 |          |   |                               | Firmware +
 |          |   |                               | Manifest
 +----------+   |                               |
                |                               |
                |                        +--------------+
                |                        |              |
 +----------+   |  Firmware + Manifest   | Distribution |
 |  Device  |---+------------------------|    System    |
 |          |   |                        |              |
 |          |   |                        |              |
 +----------+   |                        +--------------+
                |
                |
 +----------+   |
 |  Device  +---+
 |          |
 |          |
 +----------+
Figure 1: Firmware Encryption Architecture.

To offer confidentiality protection two deployment variants need to be supported:

For both variants the key distribution data, which is embedded inside the COSE_Encrypt structure, is included in the SUIT manifest.

4. New Extensions

This specification introduces two extensions to the SUIT_Parameters structure.

SUIT_Parameters //= (suit-parameter-encryption-info
    => bstr .cbor SUIT_Encryption_Info)
SUIT_Parameters //= (suit-parameter-cek-verification => bstr)

suit-parameter-encryption-info   = [TBD1: Proposed 19]
suit-parameter-cek-verification  = [TBD2: Proposed 20]
Figure 2: Extended SUIT_Parameters CDDL.

5. Content Key Distribution Methods

The sub-sections below describe two content key distribution mechanisms, namely AES Key Wrap (AES-KW) and Ephemeral-Static Diffie-Hellman (ES-DH). Other mechanisms are supported by COSE and may be supported via enhancements to this specification.

When an encrypted firmware image is sent to multiple recipients, there are different deployment options. To explain these options we use the following notation:

5.1. Content Key Distribution with AES Key Wrap

5.1.1. Introduction

The AES Key Wrap (AES-KW) algorithm is described in RFC 3394 [RFC3394], and can be used to encrypt a randomly generated content-encryption key (CEK) with a pre-shared key-encryption key (KEK). The COSE conventions for using AES-KW are specified in Section 8.5.2 of [RFC9052] and in Section 6.2.1 of [RFC9053]. The encrypted CEK is carried in the COSE_recipient structure alongside the information needed for AES-KW. The COSE_recipient structure, which is a substructure of the COSE_Encrypt structure, contains the CEK encrypted by the KEK.

The COSE_Encrypt structure conveys information for encrypting the payload, which includes information like the algorithm and the IV, even though the payload is not embedded in the COSE_Encrypt.ciphertext itself since it conveyed as detached content.

5.1.2. Deployment Options

There are three deployment options for use with AES Key Wrap for payload encryption:

  • If all authorized recipients have access to the KEK, a single COSE_recipient structure contains the encrypted CEK. The sender executes the following steps: 
      Fetch KEK(*,S)
      Generate CEK
      ENC(CEK,KEK)
      ENC(payload,CEK)
  • If recipients have different KEKs, then multiple COSE_recipient structures are included but only a single CEK is used. Each COSE_recipient structure contains the CEK encrypted with the KEKs appropriate for a given recipient. The benefit of this approach is that the payload is encrypted only once with a CEK while there is no sharing of the KEK across recipients. Hence, authorized recipients still use their individual KEK to decrypt the CEK and to subsequently obtain the plaintext. The steps taken by the sender are: 
      Generate CEK
      for i=1 to n {
         Fetch KEK_i(Ri, S)
         ENC(CEK, KEK_i)
      }
      ENC(payload,CEK)
  • The third option is to use different CEKs encrypted with KEKs of authorized recipients. Assume there are n recipients with their unique KEKs - KEK_1(R1, S),..., KEK_n(Rn, S). The sender needs to make the following steps: 
      for i=1 to n {
         Fetch KEK_i(Ri, S)
         Generate CEK_i
         ENC(CEK_i, KEK_i)
         ENC(payload,CEK_i)
      }

This approach is appropriate when no benefits can be gained from encrypting and transmitting payloads only once.

5.1.3. CDDL

The CDDL for the COSE_Encrypt_Tagged structure is shown in Figure 3.

COSE_Encrypt_Tagged = #6.96(COSE_Encrypt)

SUIT_Encryption_Info = COSE_Encrypt_Tagged

COSE_Encrypt = [
  protected   : bstr .cbor outer_header_map_protected,
  unprotected : outer_header_map_unprotected,
  ciphertext  : bstr / nil,
  recipients  : [ + COSE_recipient ]
]

outer_header_map_protected =
{
    1 => int,         ; algorithm identifier
  * label =values     ; extension point
}

outer_header_map_unprotected =
{
    5 => bstr,        ; IV
  * label =values     ; extension point
}

COSE_recipient = [
  protected   : bstr .size 0,
  unprotected : recipient_header_map,
  ciphertext  : bstr        ; CEK encrypted with KEK
]

recipient_header_map =
{
    1 => int,         ; algorithm identifier
    4 => bstr,        ; key identifier
  * label =values     ; extension point
}
Figure 3: CDDL for AES Key Wrap Encryption

Note that the AES-KW algorithm, as defined in Section 2.2.3.1 of [RFC3394], does not have public parameters that vary on a per-invocation basis. Hence, the protected parameter in the COSE_recipient structure is a byte string of zero length.

The COSE specification requires a consistent byte stream for the authenticated data structure to be created. This structure is replaced in Figure 4.

       Enc_structure = [
         context : "Encrypt",
         protected : empty_or_serialized_map,
         external_aad : bstr
       ]
Figure 4: CDDL for Enc_structure Data Structure

This Enc_structure needs to be populated as follows:

The protected field in the Enc_structure from Figure 4 refers to the content of the protected field from the COSE_Encrypt structure. It is important to note that there are two protected fields shown in Figure 3: - one in the COSE_Encrypt structure, and - a second one in the COSE_recipient structure.

The value of the external_aad MUST be set to a null value (major type 7, value 22).

5.1.4. Example

This example uses the following parameters: - Algorithm for payload encryption: AES-GCM-128 - Algorithm id for key wrap: A128KW - IV: 0x26, 0x68, 0x23, 0x06, 0xd4, 0xfb, 0x28, 0xca, 0x01, 0xb4, 0x3b, 0x80 - KEK: "aaaaaaaaaaaaaaaa" - KID: "kid-1" - Plaintext firmware (txt): "This is a real firmware image." (in hex): 546869732069732061207265616C206669726D7761726520696D6167652E

The COSE_Encrypt structure, in hex format, is (with a line break inserted):

D8608443A10101A1054C26682306D4FB28CA01B43B80F68340A2012204456B69642D
315818AF09622B4F40F17930129D18D0CEA46F159C49E7F68B644D

The resulting COSE_Encrypt structure in a diagnostic format is shown in Figure 5.

96(
    [
        / protected field with alg=AES-GCM-128 /
        h'A10101',
        {
           / unprotected field with iv /
           5: h'26682306D4FB28CA01B43B80'
        },
        / null value due to detached ciphertext /
        null,
        [ / recipients array /
           h'', / protected field /
           {    / unprotected field /
              1: -3,            / alg=A128KW /
              4: h'6B69642D31'  / key id /
           },
           / CEK encrypted with KEK /
           h'AF09622B4F40F17930129D18D0CEA46F159C49E7F68B644D'
        ]
    ]
)
Figure 5: COSE_Encrypt Example for AES Key Wrap

The CEK, in hex format, was "4C805F1587D624ED5E0DBB7A7F7FA7EB". The encrypted firmware (with a line feed added) was:

A8B6E61EF17FBAD1F1BF3235B3C64C06098EA512223260
F9425105F67F0FB6C92248AE289A025258F06C2AD70415

5.2. Content Key Distribution with Ephemeral-Static Diffie-Hellman

5.2.1. Introduction

Ephemeral-Static Diffie-Hellman (ES-DH) is a scheme that provides public key encryption given a recipient's public key. There are multiple variants of this scheme; this document re-uses the variant specified in Section 8.5.5 of [RFC9052].

The following three layer structure is used:

  • Layer 0: Has a content encrypted with the CEK. The content may be detached.
  • Layer 1: Uses the AES Key Wrap algorithm to encrypt a randomly generated CEK with the KEK derived by layer 2.
  • Layer 2: Uses ECDH Ephemeral-Static direct to generate the KEK for layer 1.

As a result, the three layers combine ECDH-ES with AES-KW. An example is given in Appendix B of RFC 9052 and in Figure 7.

5.2.2. Deployment Options

There are two deployment options with this approach. We assume that recipients are always configured with a device-unique public / private key pair.

  • A sender wants to transmit a payload to multiple recipients. All recipients shall receive the same encrypted payload, i.e. the same CEK is used. One COSE_recipient structure per recipient is used and it contains the CEK encrypted with the KEK. To generate the KEK each COSE_recipient structure contains a COSE_recipient_inner structure to carry the sender's emphemeral key and an identifier for the recipients public key. The steps taken by the sender are: 
      Generate CEK
      for i=1 to n {
         Generate KEK_i(Ri, S) using ES-DH
         ENC(CEK, KEK_i)
      }
      ENC(payload,CEK)
  • The alternative is to encrypt a payload with a different CEK for each recipient. Assume there are KEK_1(R1, S),..., KEK_n(Rn, S) have been generated for the different recipients using ES-DH. The following steps needs to be made by the sender: 
      for i=1 to n {
         Generate KEK_i(Ri, S) using ES-DH
         Generate CEK_i
         ENC(CEK_i, KEK_i)
         ENC(payload,CEK_i)
      }

This results in n-manifests. This approach is useful when payloads contain information unique to a device. The encryption operation effectively becomes ENC(payload_i,CEK_i).

5.2.3. CDDL

The CDDL for the COSE_Encrypt_Tagged structure is shown in Figure 6.

COSE_Encrypt_Tagged = #6.96(COSE_Encrypt)

SUIT_Encryption_Info = COSE_Encrypt_Tagged

COSE_Encrypt = [
  protected   : bstr .cbor outer_header_map_protected,
  unprotected : outer_header_map_unprotected,
  ciphertext  : bstr / nil,
  recipients  : [ + COSE_recipient ]
]

outer_header_map_protected =
{
    1 => int,         ; algorithm identifier
  * label =values     ; extension point
}

outer_header_map_unprotected =
{
    5 => bstr,        ; IV
  * label =values     ; extension point
}

COSE_recipient = [
  protected   : bstr .size 0,
  unprotected : recipient_header_map,
  ciphertext  : bstr        ; CEK encrypted with KEK
  recipients : [ + COSE_recipient_inner ]
]

recipient_header_map =
{
    1 => int,         ; algorithm identifier for key wrap
    4 => bstr,        ; key identifier
  * label =values     ; extension point
}


COSE_recipient_inner = [
  protected   : bstr .cbor inner_recipient_header_pr_map,
  unprotected : inner_recipient_header_unpr_map,
  ciphertext  : nil
]


inner_recipient_header_pr_map =
{
    1 => int,         ; algorithm identifier for ES-DH
  * label =values     ; extension point
}

inner_recipient_header_unpr_map =
{
    1 => int,         ; algorithm identifier
   -1 => COSE_Key,    ; ephemeral public key for the sender
    4 => bstr,        ; identifier of the recipient public key
  * label =values     ; extension point
}
Figure 6: CDDL for ES-DH-based

5.2.4. Example

This example uses the following parameters: - Algorithm for payload encryption: AES-GCM-128 - Algorithm id for key wrap: A128KW - Algorithm for ES-DH: ECDH-ES + HKDF-256 - IV: 0x26, 0x68, 0x23, 0x06, 0xd4, 0xfb, 0x28, 0xca, 0x01, 0xb4, 0x3b, 0x80 - KID: "kid-1" - Plaintext: "This is a real firmware image." - Firmware (hex): 546869732069732061207265616C206669726D7761726520696D6167652E

The COSE_Encrypt structure, in hex format, is (with a line break inserted):

D8608443A10101A1054C26682306D4FB28CA01B43B80F6818440A101225
818DBD43C4E9D719C27C6275C67D628D493F090593DB8218F11818344A1
013818A220A401022001215820B2ADD44368EA6D641F9CA9AF308B4079A
EB519F11E9B8A55A600B21233E86E6822F404456B69642D3140

The resulting COSE_Encrypt structure in a diagnostic format is shown in Figure 5.

  96(
     [
       / protected / h'a10101' / {
           \ alg \ 1:1 \ AES-GCM-128 \
         } / ,
       / unprotected / {
         / iv / 5:h'26682306D4FB28CA01B43B80'
         },
       / null value due to detached ciphertext /
         null,
       / recipients / [
         [
           / protected / h'',
           / unprotected / {
             / alg / 1:-3 / A128KW /
           },
           / ciphertext - CEK encrypted with KEK /
           h'dbd43c4e9d719c27c6275c67d628d493f090593db8218f11',
           / recipients-inner / [
             [
               / protected / h'a1013818' / {
                   \ alg \ 1:-25 \ ECDH-ES + HKDF-256 \
                 } / ,
               / unprotected / {
                 / ephemeral / -1:{
                   / kty / 1:2,
                   / crv / -1:1,
                   / x / -2:h'b2add44368ea6d641f9ca9af308b4079
                              aeb519f11e9b8a55a600b21233e86e68',
                   / y / -3:false
                 },
                 / kid / 4:'kid-1'
               },
               / ciphertext / h''
             ]
           ]
         ]
       ]
     ]
   )
Figure 7: COSE_Encrypt Example for ES-DH

6. CEK Verification

While the SUIT manifest is integrity protected and authenticated, the SUIT envelope is not protected cryptographically. Hence, an adversary located along the communication path between the sender and the recipient could modify the COSE_Encrypt structure (assuming that no other communication security mechanism is in use).

For example, if the attacker alters the key distribution data then a recipient will decrypt the firmware image with an incorrect key. This will lead to expending energy and flash cycles until the failure is detected.

To mitigate this attack, a new parameter, called suit-cek-verification, is added to the manifest. The suit-cek-verification parameter is optional to implement and optional to use. When used, it reduces the risk of a battery exhaustion attack against the IoT device.

Since the manifest is protected by a digital signature or a MAC, an adversary cannot successfully modify this value. This parameter allows the recipient to verify whether the CEK has successfully been derived.

The suit-cek-verification parameter contains a byte string resulting from the encryption of 8 bytes of 0xA5 using the CEK with a nonce of all zeros and empty additional data using the cipher algorithm and mode also used to encrypt the plaintext. The same nonce used for CEK verification MUST NOT be used to encrypt plaintext with the same CEK.

7. Firmware Updates on IoT Devices with Flash Memory.

Flash memory on microcontrollers is a type of non-volatile memory that erases data in units called blocks, pages or sectors and re-writes data at byte level (often 4-bytes). Flash memory is furthermore segmented into different memory regions, which store the bootloader, different versions of firmware images (in so-called slots), and configuration data. Figure 8 shows an example layout of a microcontroller flash area. The primary slot contains the firmware image to be executed by the bootloader, which is a common deployment on devices that do not offer the concept of position independent code.

When the encrypted firmware image has been transferred to the device, it will typically be stored in a staging area, in the secondary slot in our example.

At the next boot, the bootloader will recognize a new firmware image in the secondary slot and will start decrypting the downloaded image sector-by-sector and will swap it with the image found in the primary slot.

The swap should only take place after the signature on the plaintext is verified. Note that the plaintext firmware image is available in the primary slot only after the swap has been completed, unless "dummy decrypt" is used to compute the hash over the plaintext prior to executing the decrypt operation during a swap. Dummy decryption here refers to the decryption of the firmware image found in the secondary slot sector-by-sector and computing a rolling hash over the resulting plaintext firmware image (also sector-by-sector) without performing the swap operation. While there are performance optimizations possible, such as conveying hashes for each sector in the manifest rather than a hash of the entire firmware image, such optimizations are not described in this specification.

This approach of swapping the newly downloaded image with the previously valid image is often referred as A/B approach. A/B refers to the two slots involved. Two slots are used to allow the update to be reversed in case the newly obtained firmware image fails to boot. This approach adds robustness to the firmware update procedure.

Since the image in primary slot is available in cleartext it may need to re-encrypted it before copying it to the secondary slot. This may be necessary when the secondary slot has different access permissions or when the staging area is located in an off-chip flash memory and therefore more vulnerable to physical attacks. Note that this description assumes that the processor does not execute encrypted memory (i.e. using on-the-fly decryption in hardware).

+--------------------------------------------------+
| Bootloader                                       |
+--------------------------------------------------+
| Primary Slot                                     |
|                                        (sector 1)|
|..................................................|
|                                                  |
|                                        (sector 2)|
|..................................................|
|                                                  |
|                                        (sector 3)|
|..................................................|
|                                                  |
|                                        (sector 4)|
+--------------------------------------------------+
| Secondary Slot                                   |
|                                        (sector 1)|
|..................................................|
|                                                  |
|                                        (sector 2)|
|..................................................|
|                                                  |
|                                        (sector 3)|
|..................................................|
|                                                  |
|                                        (sector 4)|
+--------------------------------------------------+
| Swap Area                                        |
|                                                  |
+--------------------------------------------------+
| Configuration Data                               |
+--------------------------------------------------+
Figure 8: Example Flash Area Layout

The ability to restart an interrupted firmware update is often a requirement for low-end IoT devices. To fulfill this requirement it is necessary to chunk a firmware image into sectors and to encrypt each sector individually using a cipher that does not increase the size of the resulting ciphertext (i.e., by not adding an authentication tag after each encrypted block).

When an update gets aborted while the bootloader is decrypting the newly obtained image and swapping the sectors, the bootloader can restart where it left off. This technique offers robustness and better performance.

For this purpose ciphers without integrity protection are used to encrypt the firmware image. Integrity protection for the firmware image must, however, be provided and the suit-parameter-image-digest, defined in Section 8.4.8.6 of [I-D.ietf-suit-manifest], MUST be used.

[I-D.ietf-cose-aes-ctr-and-cbc] registers AES Counter mode (AES-CTR) and AES Cipher Block Chaining (AES-CBC) ciphers that do not offer integrity protection. These ciphers are useful for the use cases that require firmware encryption on IoT devices. For many other use cases where software packages, configuration information or personalization data needs to be encrypted, the use of Authenticated Encryption with Additional Data (AEAD) ciphers is preferred.

The following sub-sections provide further information about the initialization vector (IV) selection for use with AES-CBC and AES-CTR in the firmware encryption context. An IV MUST NOTE be re-used when the same key is used. For this application, the IVs are not random but rather based on the slot/sector-combination in flash memory. The text below assumes that the block-size of AES is (much) smaller than sector size. The typical sector-size of flash memory is in the order of KiB. Hence, multiple AES blocks need to be decrypted until an entire sector is completed.

7.1. AES-CBC

In AES-CBC a single IV is used for encryption of firmware belonging to a single sector since individual AES blocks are chained toghether, as shown in Figure 9. The numbering of sectors in a slot MUST start with zero (0) and MUST increase by one with every sector till the end of the slot is reached. The IV follows this numbering.

For example, let us assume the slot size of a specific flash controller on an IoT device is 64 KiB, the sector size 4096 bytes (4 KiB) and AES-128-CBC uses an AES-block size of 128 bit (16 bytes). Hence, sector 0 needs 4096/16=256 AES-128-CBC operations using IV 0. If the firmware image fills the entire slot then that slot contains 16 sectors, i.e. IVs ranging from 0 to 15.

       P1              P2
        |              |
   IV--(+)    +-------(+)
        |     |        |
        |     |        |
    +-------+ |    +-------+
    |       | |    |       |
    |       | |    |       |
 k--|  E    | | k--|  E    |
    |       | |    |       |
    +-------+ |    +-------+
        |     |        |
        +-----+        |
        |              |
        |              |
        C1             C2

Legend:
  Pi = Plaintext blocks
  Ci = Ciphertext blocks
  E = Encryption function
  k = Symmetric key
  (+) = XOR operation
Figure 9: AES-CBC Operation

7.2. AES-CTR

Unlike AES-CBC, AES-CTR uses an IV per AES operation, as shown in Figure 10. Hence, when an image is encrypted using AES-CTR-128 or AES-CTR-256, the IV MUST start with zero (0) and MUST be incremented by one for each 16-byte plaintext block within the entire slot.

Using the previous example with a slot size of 64 KiB, the sector size 4096 bytes and the AES plaintext block size of 16 byte requires IVs from 0 to 255 in the first sector and 16 * 256 IVs for the remaining sectors in the slot. The last IV used to encrypt data in the slot is therefore

         IV1            IV2
          |              |
          |              |
          |              |
      +-------+      +-------+
      |       |      |       |
      |       |      |       |
   k--|  E    |   k--|  E    |
      |       |      |       |
      +-------+      +-------+
          |              |
     P1--(+)        P2--(+)
          |              |
          |              |
          C1             C2

Legend:
  See previous diagram.
Figure 10: AES-CTR Operation

8. Complete Examples

[[Editor's Note: Add examples for a complete manifest here (including a digital signature), multiple recipients, encryption of manifests (in comparison to firmware images).]]

The following manifests examplify how to deliver the encrypted firmware and its encryption info to the Devices.

The examples are signed using the following ECDSA secp256r1 key:

-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgApZYjZCUGLM50VBC
CjYStX+09jGmnyJPrpDLTz/hiXOhRANCAASEloEarguqq9JhVxie7NomvqqL8Rtv
P+bitWWchdvArTsfKktsCYExwKNtrNHXi9OB3N+wnAUtszmR23M4tKiW
-----END PRIVATE KEY-----

The corresponding public key can be used to verify these examples:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEhJaBGq4LqqvSYVcYnuzaJr6qi/Eb
bz/m4rVlnIXbwK07HypLbAmBMcCjbazR14vTgdzfsJwFLbM5kdtzOLSolg==
-----END PUBLIC KEY-----

Each example uses SHA-256 as the digest function.

8.1. AES Key Wrap Example

Diagnostic notation of the SUIT manifest (with line breaks added for readability).

/ SUIT_Envelope_Tagged / 107( {
  / suit-authentication-wrapper / 2: << [
    / digest: / << [
      / suit-digest-algorithm-id: / -16 / SHA256 /,
      / suit-digest-bytes: /
      h'A447024C395B90095678C174C4075F3
      21EF29A57A0A028D01080019E5B21ED5F'
    ] >>,
    / signatures: / << / COSE_Sign1_Tagged / 18( [
      / protected: / << {
        / alg / 1: -7 / ES256 /
      } >>,
      / unprotected: / {},
      / payload: / null,
      / signature: /
      h'65C40240E28F7F02046CE85F8343A78
      86B349D2523B3A815C161D54337395721
      953ACA109690B3588761195071BCF04D5
      57260484B4B281C508D9E95FED4B9EF'
    ] ) >>
  ] >>,
  / suit-manifest / 3: << {
    / suit-manifest-version / 1: 1,
    / suit-manifest-sequence-number / 2: 1,
    / suit-common / 3: << {
      / suit-components / 2: [
        [h'00'] / to be decrypted firmware /,
        [h'01'] / encrypted firmware /
      ]
    } >>,
    / suit-install / 17: << [
      / fetch encrypted firmware /
      / suit-directive-set-component-index / 12, 1 / [h'01'] /,
      / suit-directive-override-parameters / 20, {
        / suit-parameter-uri /
        21: "https://author.example.com/encrypted-firmware.bin",
        / suit-parameter-image-digest / 3: << [
          / suit-digest-algorithm-id: / -16 / SHA256 /,
          / suit-digest-bytes: /
          h'F63187728B49B0E57FE891B932C9C88
          1735D880EFAE69A9A4D45E0FE72C70DA1'
        ] >>,
        / suit-parameter-image-size / 14: 46
      },
      / suit-directive-fetch / 21, 15,
      / suit-condition-image-match / 3, 15,

      / decrypt encrypted firmware /
      / suit-directive-set-component-index / 12, 0 / [h'00'] /,
      / suit-directive-override-parameters / 20, {
        / suit-parameter-source-component / 22: 1 / [h'01'] /,
        / suit-parameter-encryption-info<TBD1> / 19: 96( [
          / protected: / << {
            / alg / 1: 1 / AES-GCM-128 /
          } >>,
          / unprotected: / {
             / iv / 5: h'26682306D4FB28CA01B43B80'
          },
          / payload: / null / detached ciphertext /,
          / recipients: / [
             / protected / h'',
             / unprotected / {
               / alg / 1: -3 / A128KW /,
               / kid / 4: h'6B69642D31'
              },
             / payload: CEK encrypted with KEK /
             h'AF09622B4F40F17930129D18D0C
             EA46F159C49E7F68B644D'
          ]
        ] )
      },
      / suit-directive-copy / 22, 15
      / consumes the SUIT_Encryption_Info above /,

      / verify decrypted firmware /
      / suit-directive-override-parameters / 20, {
        / suit-parameter-image-digest / 3: << [
          / suit-digest-algorithm-id: / -16 / SHA256 /,
          / suit-digest-bytes: /
          h'36921488FE6680712F734E11F58D87E
          EB66D4B21A8A1AD3441060814DA16D50F'
        ] >>,
        / suit-parameter-image-size / 14: 30
      },
      / suit-condition-image-match / 3, 15
    ] >>
  } >>
} )

In hex:

D86BA2025873825824822F5820A447024C395B90095678C174C4075F321E
F29A57A0A028D01080019E5B21ED5F584AD28443A10126A0F6584065C402
40E28F7F02046CE85F8343A7886B349D2523B3A815C161D5433739572195
3ACA109690B3588761195071BCF04D557260484B4B281C508D9E95FED4B9
EF0358EEA4010102010349A102828141008141011158DB920C0114A31578
3168747470733A2F2F617574686F722E6578616D706C652E636F6D2F656E
637279707465642D6669726D776172652E62696E035824822F5820F63187
728B49B0E57FE891B932C9C881735D880EFAE69A9A4D45E0FE72C70DA10E
182E150F030F0C0014A2160113D8608443A10101A1054C26682306D4FB28
CA01B43B80F68340A2012204456B69642D315818AF09622B4F40F1793012
9D18D0CEA46F159C49E7F68B644D160F14A2035824822F582036921488FE
6680712F734E11F58D87EEB66D4B21A8A1AD3441060814DA16D50F0E181E
030F

9. Security Considerations

The algorithms described in this document assume that the party performing payload encryption

Both cases require some upfront communication interaction. This interaction is likely provided by an IoT device management solution, as described in [RFC9019].

For AES Key Wrap to provide high security it is important that the KEK is of high entropy, and that implementations protect the KEK from disclosure. Compromise of the KEK may result in the disclosure of all key data protected with that KEK.

Since the CEK is randomly generated, it must be ensured that the guidelines for random number generation in [RFC8937] are followed.

In some cases third party companies analyse binaries for known security vulnerabilities. With encrypted payloads this type of analysis is prevented. Consequently, these third party companies either need to be given access to the plaintext binary before encryption or they need to become authorized recipients of the encrypted payloads. In either case, it is necessary to explicitly consider those third parties in the software supply chain when such a binary analysis is desired.

10. IANA Considerations

IANA is asked to add two values to the SUIT_Parameters registry established by [I-D.ietf-suit-manifest].

Label      Name                 Reference
-----------------------------------------
TBD1       Encryption Info      Section 4
TBD2       CEK Verification     Section 4

[Editor's Note: - TBD1: Proposed 19 - TBD2: Proposed 20 ]

11. References

11.1. Normative References

[I-D.ietf-cose-aes-ctr-and-cbc]
Housley, R. and H. Tschofenig, "CBOR Object Signing and Encryption (COSE): AES-CTR and AES-CBC", Work in Progress, Internet-Draft, draft-ietf-cose-aes-ctr-and-cbc-03, , <https://datatracker.ietf.org/doc/html/draft-ietf-cose-aes-ctr-and-cbc-03>.
[I-D.ietf-suit-manifest]
Moran, B., Tschofenig, H., Birkholz, H., Zandberg, K., and O. Rønningstad, "A Concise Binary Object Representation (CBOR)-based Serialization Format for the Software Updates for Internet of Things (SUIT) Manifest", Work in Progress, Internet-Draft, draft-ietf-suit-manifest-22, , <https://datatracker.ietf.org/doc/html/draft-ietf-suit-manifest-22>.
[RFC2119]
Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, , <https://www.rfc-editor.org/rfc/rfc2119>.
[RFC3394]
Schaad, J. and R. Housley, "Advanced Encryption Standard (AES) Key Wrap Algorithm", RFC 3394, DOI 10.17487/RFC3394, , <https://www.rfc-editor.org/rfc/rfc3394>.
[RFC8174]
Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, , <https://www.rfc-editor.org/rfc/rfc8174>.
[RFC9052]
Schaad, J., "CBOR Object Signing and Encryption (COSE): Structures and Process", STD 96, RFC 9052, DOI 10.17487/RFC9052, , <https://www.rfc-editor.org/rfc/rfc9052>.
[RFC9053]
Schaad, J., "CBOR Object Signing and Encryption (COSE): Initial Algorithms", RFC 9053, DOI 10.17487/RFC9053, , <https://www.rfc-editor.org/rfc/rfc9053>.

11.2. Informative References

[iana-suit]
Internet Assigned Numbers Authority, "IANA SUIT Manifest Registry", , <TBD>.
[RFC5280]
Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, , <https://www.rfc-editor.org/rfc/rfc5280>.
[RFC5652]
Housley, R., "Cryptographic Message Syntax (CMS)", STD 70, RFC 5652, DOI 10.17487/RFC5652, , <https://www.rfc-editor.org/rfc/rfc5652>.
[RFC8937]
Cremers, C., Garratt, L., Smyshlyaev, S., Sullivan, N., and C. Wood, "Randomness Improvements for Security Protocols", RFC 8937, DOI 10.17487/RFC8937, , <https://www.rfc-editor.org/rfc/rfc8937>.
[RFC9019]
Moran, B., Tschofenig, H., Brown, D., and M. Meriac, "A Firmware Update Architecture for Internet of Things", RFC 9019, DOI 10.17487/RFC9019, , <https://www.rfc-editor.org/rfc/rfc9019>.
[RFC9124]
Moran, B., Tschofenig, H., and H. Birkholz, "A Manifest Information Model for Firmware Updates in Internet of Things (IoT) Devices", RFC 9124, DOI 10.17487/RFC9124, , <https://www.rfc-editor.org/rfc/rfc9124>.
[ROP]
Wikipedia, "Return-Oriented Programming", , <https://en.wikipedia.org/wiki/Return-oriented_programming>.

Appendix A. Acknowledgements

We would like to thank Henk Birkholz for his feedback on the CDDL description in this document. Additionally, we would like to thank Michael Richardson, Øyvind Rønningstad, Dave Thaler, and Carsten Bormann for their review feedback. Finally, we would like to thank Dick Brooks for making us aware of the challenges firmware encryption imposes on binary analysis.

Authors' Addresses

Hannes Tschofenig
Russ Housley
Vigil Security, LLC
Brendan Moran
Arm Limited
David Brown
Linaro
Ken Takayama
SECOM CO., LTD.