Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clarify implementation of REQ.SEC.MFST.CHECK #31

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Clarify implementation of REQ.SEC.MFST.CHECK #31

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions draft-ietf-suit-information-model.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,7 @@ This element is REQUIRED.

## Monotonic Sequence Number {#element-sequence-number}

A monotonically increasing (unsigned) sequence number to prevent malicious actors from reverting a firmware update against the policies of the relevant authority. This number must not wrap around.
A monotonically increasing (unsigned) sequence number to prevent malicious actors from reverting a firmware update against the policies of the relevant authority. This number must not wrap around.

For convenience, the monotonic sequence number may be a UTC timestamp. This allows global synchronisation of sequence numbers without any additional management.

Expand Down Expand Up @@ -793,7 +793,7 @@ Keys SHOULD be stored in a way that limits the risk of a legitimate, but comprom

Mitigates: [THREAT.KEY.EXPOSURE](#threat-key-exposure)

Implemented by: Hardware-assisted isolation technologies, which are outside the scope of the manifest format.
Implemented by: Hardware-assisted isolation technologies, which are outside the scope of the manifest format.

### REQ.SEC.KEY.ROTATION: Protected storage of signing keys {#req-sec-key-rotation}

Expand All @@ -803,7 +803,7 @@ If key expiration is performed based on time, then a secure clock is needed. If

Mitigates: [THREAT.KEY.EXPOSURE](#threat-key-exposure)

Implemented by: Secure storage technology, which is a system design/implementation aspect outside the scope of the manifest format.
Implemented by: Secure storage technology, which is a system design/implementation aspect outside the scope of the manifest format.


### REQ.SEC.MFST.CHECK: Validate manifests prior to deployment {#req-sec-mfst-check}
Expand All @@ -812,15 +812,15 @@ Manifests SHOULD be verified prior to deployment. This reduces problems that may

Mitigates: [THREAT.MFST.MODIFICATION](#threat-mfst-modification)

Implemented by: Testing infrastructure. While outside the scope of the manifest format, proper testing of low-level software is essential for avoiding unnecessary down-time or worse situations.
Implemented by: Testing and distribution infrastructure. While outside the scope of the manifest format, proper testing of low-level software is essential for avoiding unnecessary down-time or worse situations. Distribution infrastructure can reduce bandwidth, save battery power, and avoid unnecessary down-time by validating manifests before sending them to recipient devices.

### REQ.SEC.MFST.TRUSTED: Construct manifests in a trusted environment {#req-sec-mfst-trusted}

For high risk deployments, such as large numbers of devices or critical function devices, manifests SHOULD be constructed in an environment that is protected from interference, such as an air-gapped computer. Note that a networked computer connected to an HSM does not fulfill this requirement (see [THREAT.MFST.MODIFICATION](#threat-mfst-modification)).

Mitigates: [THREAT.MFST.MODIFICATION](#threat-mfst-modification)

Implemented by: Physical and network security for protecting the environment where firmware updates are prepared to avoid unauthorized access to this infrastructure.
Implemented by: Physical and network security for protecting the environment where firmware updates are prepared to avoid unauthorized access to this infrastructure.

### REQ.SEC.MFST.CONST: Manifest kept immutable between check and use {#req-sec-mfst-const}

Expand Down