Subject: [its] Fwd: UPTANE - automotive software update project

From: Russ Housley <[email-masked]>
Date: Mon, 10 Oct 2016 13:12:19 -0400

This may be of interest to people on this list.

Russ

---------- Forwarded message ----------
From: Ira McDonald <[email-masked]>
Date: Sun, Oct 9, 2016 at 2:32 PM
Subject: Re: [saag] software update for teeny-weeny devices
To: Stephen Farrell <[email-masked]>, Ira McDonald <[email-masked]>

Hi Stephen,

Thank you for this excellent summary of the IoT SU workshop.

I wanted to point out to you a large project (several million dollars)
funded by US DHS at UMTRI (University of Michigan Transportation
Research Institute), NYU, and SwRI for an open standard with a
reference implementation for high-security Software Over-the-Air
updates for automotive ECUs (those little boxes all over under the
hood) called UPTANE:

https://uptane.umtri.umich.edu/

This project builds on the NYU TUF project (widely used in the
mainstream computer industry) and has a wonderfully rich threat
model (e.g., assume ALL of your back-end servers and one or
more or the "primary" ECUs in your car have been taken over
completely by bad guys - detect this condition from a downstream
"secondary" ECU and initiate the full recovery) and uses multiple
signatures from different parties (i.e, don't trust that the OEM's 
PKI servers have not been breached).

Outside the auto industry, the journalists and marketers seem
to think that auto ECUs are just some more IoT devices.  Well
maybe, but there are 100 of them in a 2016 luxury model and it
costs $60K or more.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions WG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: [email-masked]
Jan-April: 579 Park Place  Saline, MI  48176  734-944-0094
May-Dec: PO Box 221  Grand Marais, MI 49839  906-494-2434

On Sun, Oct 9, 2016 at 1:59 PM, Stephen Farrell <[email-masked]> wrote:

Hi Peter,

On 09/10/16 03:22, Peter Gutmann wrote:
> Stephen Farrell <[email-masked]> writes:
>
> Just had a quick skim through this (I've printed it out for later reading when
> I've got more time), but wanted to post my immediate response to one of the
> points I saw:
>
>> There was a bit of discussion about the importance for IoT devices to know
>> the current time for the purpose of checking certificate validity.
>
> "And now you have two problems...".
>
> It'd also be good to have a problem statement of some kind rather than just a
> shopping list of stuff, or some indication of where the authors are coming
> from when they create their list.

The authors of the draft are just trying to reflect what
happened at the workshop (as it says in the draft).

> I've never seen an IoT device that can
> handle differential updates, has dynamic linking (or dynamic anything, there's
> usually just a single system image), and a whole pile of other stuff discussed
> here.  Is this just gedanken-experimenting or are there real devices being
> considered?  It looks like a lot of the issues being raised simply don't apply
> to most IoT devices...

A lot of course depends on what devices one associates with
the marketing-term IoT. One of the companies who attended
the workshop (electric imp) do updates that were more
complex than I had thought were done but iirc the complex
update schemes only or mostly applied to bigger devices.
I forget if they claimed differential updates or not. I
do recall that a colleague of mine who does s/w engineering
research was interested in research in that space.

If the text of the draft gives the wrong impression about
any of that, I'd appreciate pointers to help us fix it.

And of course, I'd be even more interested if there are
bits of work that could help improve the likelihood that
small devices get updated. And, on this list, most especially
if there's stuff it'd be worth doing in the IETF. (Personally
I think there are things the IETF could do to help, but I'm
not sure if the bits of work the IETF could do would really
see deployment and there's no point doing paperwork for
fun.)

S.