Arm Limited

hannes.tschofenig@arm.com

Vigil Security, LLC

housley@vigilsec.com

Arm Limited

Brendan.Moran@arm.com

Security SUIT Internet-Draft This document specifies a firmware update mechanism where the firmware image is encrypted. This mechanism uses the IETF SUIT manifest with key establishment provided by the hybrid public-key encryption (HPKE) scheme or AES Key Wrap (AES-KW) with a pre-shared key-encryption key. In either case, AES-GCM or AES-CCM is used for firmware encryption.

Vulnerabilities with Internet of Things (IoT) devices have raised the need for a reliable and secure firmware update mechanism that is also suitable for constrained devices. To protect firmware images the SUIT manifest format was developed . The SUIT manifest provides a bundle of metadata about the firmware for an IoT device, where to find the firmware image, and the devices to which it applies. The SUIT information model details the information that has to be offered by the SUIT manifest format. In addition to offering protection against modification, which is provided by a digital signature or a message authentication code, the firmware image may also be afforded confidentiality using encryption. Encryption prevents third parties, including attackers, from gaining access to the firmware image. For example, return-oriented programming (ROP) requires intimate knowledge of the target firmware and encryption makes this approach much more difficult to exploit. The SUIT manifest provides the data needed for authorized recipients of the firmware image to decrypt it. A symmetric cryptographic key is established for encryption and decryption, and that key can be applied to a SUIT manifest, firmware images, or personalization data, depending on the encryption choices of the firmware author. This symmetric key can be established using a variety of mechanisms; this document defines two approaches for use with the IETF SUIT manifest. Key establishment can be provided by the hybrid public-key encryption (HPKE) scheme or AES Key Wrap (AES-KW) with a pre-shared key-encryption key. These choices reduce the number of possible key establishment options and thereby help increase interoperability between different SUIT manifest parser implementations. The document also contains a number of examples for developers.

The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “NOT RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. This document assumes familiarity with the IETF SUIT manifest and the SUIT architecture . In context of encryption, the terms “recipient” and “firmware consumer” are used interchangeably. Additionally, the following abbreviations are used in this document: Key Wrap (KW), defined in RFC 3394 for use with AES. Key-encryption key / key-encrypting key (KEK), a term defined in RFC 4949 . Content-encryption key (CEK), a term defined in RFC 2630 . Hybrid Public Key Encryption (HPKE), defined in .

Figure 1 in shows the architecture for distributing firmware images and manifests from the author to the firmware consumer. It does, however, not detail the use of encrypted firmware images. therefore focuses on those aspects. The firmware server and the device management infrastructure is represented by the distribution system, which is aware of the individual devices a firmware update has to be delivered to. Firmware encryption requires the party doing the encryption to know either the KEK (in case of AES-KW) or the public key of the recipient (in case of HPKE). The firmware author may have knowledge about all the devices but in most cases this will not be likely. Hence, it is the responsibility of the distribution system to perform the firmware encryption. Since including the COSE_Encrypt structure in the manifest invalidates a a digital signature or a MAC added by the author, this structure needs to be added to the envelope by the distribution system. This approach offers flexiblity when the number of devices that need to receive encrypted firmware images changes dynamically or when the updates to KEKs or recipient public keys are necessary. As a downside, the author needs to trust the distribution system with performing the encryption of the plaintext firmware image.

The AES Key Wrap (AES-KW) algorithm is described in RFC 3394 , and it can be used to encrypt a randomly generated content-encryption key (CEK) with a pre-shared key-encryption key (KEK). The COSE conventions for using AES-KW are specified in Section 12.2.1 of . The encrypted CEK is carried in the COSE_recipient structure alongside the information needed for AES-KW. The COSE_recipient structure, which is a substructure of the COSE_Encrypt structure, contains the CEK encrypted by the KEK. When the firmware image is encrypted for use by multiple recipients, there are three options: If all of authorized recipients have access to the KEK, a single COSE_recipient structure contains the encrypted CEK. If recipients have different KEKs, then the COSE_recipient structure may contain the same CEK encrypted with many different KEKs. The benefit of this approach is that the firmware image is encrypted only once with the CEK while the authorized recipients still need to use their individual KEKs to obtain the plaintext. The last option is to use different CEKs encrypted with KEKs of the authorized recipients. This is appropriate when no benefits can be gained from encrypting and transmitting firmware images only once. For example, firmware images may contain information unique to a device instance. Note that the AES-KW algorithm, as defined in Section 2.2.3.1 of , does not have public parameters that vary on a per-invocation basis. Hence, the protected structure in the COSE_recipient is a byte string of zero length. The COSE_Encrypt conveys information for encrypting the firmware image, which includes information like the algorithm and the IV, even though the firmware image is not embedded in the COSE_Encrypt.ciphertext itself since it conveyed as detached content. The CDDL for the COSE_Encrypt_Tagged structure is shown in .

int, ; algorithm identifier * label =values ; extension point } outer_header_map_unprotected = { 5 => bstr, ; IV * label =values ; extension point } COSE_recipient = [ protected : bstr .size 0, unprotected : recipient_header_map, ciphertext : bstr ; CEK encrypted with KEK ] recipient_header_map = { 1 => int, ; algorithm identifier 4 => bstr, ; key identifier * label =values ; extension point } ]]>

The COSE specification requires a consistent byte stream for the authenticated data structure to be created, which is shown in .

As shown in , there are two protected fields: one protected field in the COSE_Encrypt structure and a second one in the COSE_recipient structure. The ‘protected’ field in the Enc_structure, see , refers to the content of the protected field from the COSE_Encrypt structure, not to the protected field of the COSE_recipient structure. The value of the external_aad is set to null. The following example illustrates the use of the AES-KW algorithm with AES-128. We use the following parameters in this example: IV: 0x26, 0x68, 0x23, 0x06, 0xd4, 0xfb, 0x28, 0xca, 0x01, 0xb4, 0x3b, 0x80 KEK: “aaaaaaaaaaaaaaaa” KID: “kid-1” Plaintext Firmware: “This is a real firmware image.” Firmware (hex): 546869732069732061207265616C206669726D7761726520696D6167652E The COSE_Encrypt structure in hex format is (with a line break inserted):

The resulting COSE_Encrypt structure in a dignostic format is shown in .

The CEK was “4C805F1587D624ED5E0DBB7A7F7FA7EB” and the encrypted firmware was:

Hybrid public-key encryption (HPKE) is a scheme that provides public key encryption of arbitrary-sized plaintexts given a recipient’s public key. For use with firmware encryption the scheme works as follows: The firmware author uses HPKE, which internally utilizes a non-interactive ephemeral-static Diffie-Hellman exchange to derive a shared secret, which is then used to encrypt plaintext. In the firmware encryption scenario, the plaintext passed to HPKE for encryption is the randomly generated CEK. The output of the HPKE operation is therefore the encrypted CEK along with HPKE encapsulated key (i.e. the ephemeral ECDH public key of the author). The CEK is then used to encrypt the firmware. Only the holder of recipient’s private key can decapsulate the CEK to decrypt the firmware. Key generation is influced by additional parameters, such as identity information. This approach allows all recipients to use the same CEK to encrypt the firmware image, in case there are multiple recipients, to fulfill a requirement for the efficient distribution of firmware images using a multicast or broadcast protocol. The CDDL for the COSE_Encrypt structure as used with HPKE is shown in .

int, ; algorithm identifier ? 2 => crv, ; EC identifier ? 4 => bstr, ; key identifier ? 5 => bstr ; IV ) ]]>

The COSE_Encrypt structure in requires the encrypted CEK and the ephemeral public key of the firmare author to be generated. This is accomplished with the HPKE encryption function as shown in .

Legend: The functions DeserializePublicKey(), SetupBaseS() and Seal() are defined in HPKE . CEK is a random byte sequence of keysize length whereby keysize corresponds to the size of the indicated symmetric encryption algorithm used for firmware encryption. For example, AES-128-GCM requires a 16 byte key. The CEK would therefore be 16 bytes long. ‘recipient_public_key’ represents the public key of the recipient. ‘info’ is a data structure described below used as input to the key derivation internal to the HPKE algorithm. In addition to the constant prefix, the COSE_KDF_Context structure is used. The COSE_KDF_Context is shown in . The result of the above-described operation is the encrypted CEK (denoted as ciphertext) and the enc - the HPKE encapsulated key (i.e. the ephemeral ECDH public key of the author).

Notes: PartyUInfo.identity corresponds to the kid found in the COSE_Sign_Tagged or COSE_Sign1_Tagged structure (when a digital signature is used). When utilizing a MAC, then the kid is found in the COSE_Mac_Tagged or COSE_Mac0_Tagged structure. PartyVInfo.identity corresponds to the kid used for the respective recipient from the inner-most recipients array. The value in the AlgorithmID field corresponds to the alg parameter in the protected structure in the inner-most recipients array. keyDataLength is set to the number of bits of the desired output value. protected refers to the protected structure of the inner-most array. The author encrypts the firmware using the CEK with the selected algorithm. The recipient decrypts the encrypted CEK, using two input parameters: the private key skR corresponding to the public key pkR used by the author when creating the manifest. the HPKE encapsulated key (i.e. ephemeral ECDH public key) created by the author. If the HPKE operation is successful, the recipient obtains the CEK and can decrypt the firmware. shows the HPKE computations performed by the recipient for decryption.

An example of the COSE_Encrypt structure using the HPKE scheme is shown in . It uses the following algorithm combination: AES-GCM-128 for encryption of the firmware image. AES-GCM-128 for encrytion of the CEK. Key Encapsulation Mechanism (KEM): NIST P-256 Key Derivation Function (KDF): HKDF-SHA256

TBD: Example for complete manifest here (which also includes the digital signature). TBD: Multiple recipient example as well. TBD: Encryption of manifest (in addition of firmware encryption).

The algorithms described in this document assume that the firmware author has either shared a key-encryption key (KEK) with the firmware consumer (for use with the AES-Key Wrap scheme), or is in possession of the public key of the firmware consumer (for use with HPKE). Both cases require some upfront communication interaction, which is not part of the SUIT manifest. This interaction is likely provided by an IoT device management solution, as described in . For AES-Key Wrap to provide high security it is important that the KEK is of high entropy, and that implementations protect the KEK from disclosure. Compromise of the KEK may result in the disclosure of all key data protected with that KEK. Since the CEK is randomly generated, it must be ensured that the guidelines for random number generations are followed, see . In some cases third party companies analyse binaries for known security vulnerabilities. With encrypted firmware images this type of analysis is prevented. Consequently, these third party companies either need to be given access to the plaintext binary before encryption or they need to become authorized recipients of the encrypted firmware images. In either case, it is necessary to explicitly consider those third parties in the software supply chain when such a binary analysis is desired.

This document requests IANA to create new entries in the COSE Algorithms registry established with .

Arm Limited Arm Limited Fraunhofer SIT Inria This specification describes the format of a manifest. A manifest is a bundle of metadata about code/data obtained by a recipient (chiefly the firmware for an IoT device), where to find the that code/data, the devices to which it applies, and cryptographic information protecting the manifest. Software updates and Trusted Invocation both tend to use sequences of common operations, so the manifest encodes those sequences of operations, rather than declaring the metadata. In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. Concise Binary Object Representation (CBOR) is a data format designed for small code size and small message size. There is a need for the ability to have basic security services defined for this data format. This document defines the CBOR Object Signing and Encryption (COSE) protocol. This specification describes how to create and process signatures, message authentication codes, and encryption using CBOR for serialization. This specification additionally describes how to represent cryptographic keys using CBOR. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. Cisco Inria Inria Cloudflare This document describes a scheme for hybrid public-key encryption (HPKE). This scheme provides authenticated public key encryption of arbitrary-sized plaintexts for a recipient public key. HPKE works for any combination of an asymmetric key encapsulation mechanism (KEM), key derivation function (KDF), and authenticated encryption with additional data (AEAD) encryption function. We provide instantiations of the scheme using widely used and efficient primitives, such as Elliptic Curve Diffie-Hellman key agreement, HKDF, and SHA2. This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF. August Cellars Concise Binary Object Representation (CBOR) is a data format designed for small code size and small message size. There is a need for the ability to have basic security services defined for this data format. THis document defines a set of algorithms that can be used with the CBOR Object Signing and Encryption (COSE) protocol RFC XXXX. Vulnerabilities in Internet of Things (IoT) devices have raised the need for a reliable and secure firmware update mechanism suitable for devices with resource constraints. Incorporating such an update mechanism is a fundamental requirement for fixing vulnerabilities, but it also enables other important capabilities such as updating configuration settings and adding new functionality.In addition to the definition of terminology and an architecture, this document provides the motivation for the standardization of a manifest format as a transport-agnostic means for describing and protecting firmware updates. Arm Limited Arm Limited Fraunhofer SIT Vulnerabilities with Internet of Things (IoT) devices have raised the need for a reliable and secure firmware update mechanism that is also suitable for constrained devices. Ensuring that devices function and remain secure over their service life requires such an update mechanism to fix vulnerabilities, to update configuration settings, as well as adding new functionality. One component of such a firmware update is a concise and machine- processable meta-data document, or manifest, that describes the firmware image(s) and offers appropriate protection. This document describes the information that must be present in the manifest. Randomness is a crucial ingredient for Transport Layer Security (TLS) and related security protocols. Weak or predictable "cryptographically secure" pseudorandom number generators (CSPRNGs) can be abused or exploited for malicious purposes. An initial entropy source that seeds a CSPRNG might be weak or broken as well, which can also lead to critical and systemic security problems. This document describes a way for security protocol implementations to augment their CSPRNGs using long-term private keys. This improves randomness from broken or otherwise subverted CSPRNGs.This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF. This document describes the Cryptographic Message Syntax. This syntax is used to digitally sign, digest, authenticate, or encrypt arbitrary messages. [STANDARDS-TRACK] This Glossary provides definitions, abbreviations, and explanations of terminology for information system security. The 334 pages of entries offer recommendations to improve the comprehensibility of written material that is generated in the Internet Standards Process (RFC 2026). The recommendations follow the principles that such writing should (a) use the same term or definition whenever the same concept is mentioned; (b) use terms in their plainest, dictionary sense; (c) use terms that are already well-established in open publications; and (d) avoid terms that either favor a particular vendor or favor a particular technology or mechanism over other, competing techniques that already exist or could be developed. This memo provides information for the Internet community.

We would like to thank Henk Birkholz for his feedback on the CDDL description in this document. Additionally, we would like to thank Michael Richardson and Carsten Bormann for their review feedback. Finally, we would like to thank Dick Brooks for making us aware of the challenges firmware encryption imposes on binary analysis.