Subject: Re: [Fud] FUD BarBOF Location

From: Emmanuel Baccelli <[email-masked]>
Date: Wed, 5 Apr 2017 15:19:13 +0200

Hi Hannes,
are some memo/meeting notes planned to be sent on the list, for those who
could not attend?
Thanks!
Best,
Emmanuel

On Thu, Mar 30, 2017 at 12:25 AM, Hannes Tschofenig <
[email-masked]> wrote:

> Btw, as mentioned before, we meet tomorrow evening at 7pm.
>
> On 03/30/2017 12:23 AM, Hannes Tschofenig wrote:
> > Hi all,
> >
> > based on a suggestion from Paul Hoffmann I am suggesting to meet folks
> > at the hotel bar of the "Fairmont Hotel", which is just around the
> > corner of the IETF meeting venue.
> >
> > To make a reservation it would be great if those who are interested to
> > discuss the firmware update topic please add their name to this Doodle
> > poll:
> > http://doodle.com/poll/bg3asdf28ruzsacq
> >
> > Ciao
> > Hannes
> >
> >
>
>
> _______________________________________________
> Fud mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/fud
>
>

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 5 Apr 2017 15:31:27 +0200

I’m not sure that anyone kept detailed notes, but the gist of the meeting was approximately:

— firmware updates for general purpose class computers (Linux etc., “A-class”, OpenWRT routers, ...) are rather different from those for microcontrollers (“M-class”)
— we should probably look specifically at the latter
— initial focus on complete firmware replacement (we did talk about bootloaders vs. primary/recovery loaders etc.)
— the next step could be defining what set of metadata should be provided for a such a firmware image
— RFC 4108 is out there but may not exactly be what is needed for M-class today
— coswid (no, not the Trojan horse) might be one format to look at

Grüße, Carsten

> On Apr 5, 2017, at 15:19, Emmanuel Baccelli <[email-masked]> wrote:
> 
> Hi Hannes, 
> are some memo/meeting notes planned to be sent on the list, for those who could not attend?
> Thanks!
> Best,
> Emmanuel
> 
> On Thu, Mar 30, 2017 at 12:25 AM, Hannes Tschofenig <[email-masked]> wrote:

---

From: Michael Richardson <[email-masked]>
Date: Thu, 06 Apr 2017 11:46:54 -0400

Carsten Bormann <[email-masked]> wrote:
    > — firmware updates for general purpose class computers (Linux etc.,
    > “A-class”, OpenWRT routers, ...) are rather different from those for
    > microcontrollers (“M-class”)

well, Hannes kept saying that, and a number of us kept saying that in fact
it wasn't true.   Writing a 1GB image onto a 1.1GB NAND boot partition
could be as difficult to get right as writing a 31K image into a 32K NAND
partition.  The only difference being what you can fit in the "extra" space.
(100M of bootloader space vs 1K of bootloader space...)

OpenWRT routers and Smartphone updates are very much closer to M-class than
they are to "Linux" desktops. It's a signed blob, and often there isn't space
to double buffer it at all.

If it is useful for me to write up my minimal (D)TLS receiver concept for
firmware updates, I will do that.

    > — we should probably look specifically at the latter

Agreed.

    > — initial focus on complete firmware replacement (we did talk about
    > bootloaders vs. primary/recovery loaders etc.)

    > — coswid (no, not the Trojan horse) might be one format to look at

I think that we should consider updates to 4108.
If we don't like 4108, then we should consider a non-ASN1, non-PKIX format
format (JOSE for instance).

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Russ Housley <[email-masked]>
Date: Thu, 6 Apr 2017 16:30:14 -0400

> format (JOSE for instance).

If people want to update RFC 4108, I’m willing to help.  I have worked with some people to decode the necessary parts with very simple code.  It does not require a compiler.  The vital thing is that the signature gets checked!

Russ