Subject: [Suit] SUIT Charter: Multisource signed manifest and permission model

From: Suhas Nandakumar <[email-masked]>
Date: Wed, 22 Nov 2017 15:43:46 -0800

Hi All,

The current charter says the following about allowing manifest and firmware
signed by different sources and having an expressive permissions model.

"""

To support a wide range of deployment scenarios, the formats are expected
to be expressive enough to allow the use of different software sources and
permission models.

"""

I think the whole idea of multiple people signing is very unclear on the
requirements and its applicability or its widespread use. Most common
deployments today follow the model of single vendor signing the firmware. A
certification lab might certify that a given version meets some
requirements and and an operator might use that information to decide what
version they deploy but neither the certification lab or the operator sign
anything.

I propose that the WG should reconsider this requirement for scoping
purposes and should consider multi-vendor signing/permissions model  as a
future extension instead. This should be removed unless we can specify what
the need is and be clear on the trust models supported.

Cheers
Suhas Nandakumar

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 23 Nov 2017 07:34:11 +0000

Hi Suhas,

You are already into solution territory. I think we should discuss such concepts later, after the chartering space.

Currently the sentence only says that we want to support different deployment scenarios.

Do you disagree that it should support different deployment scenarios?

Note that it does not say “multiple signatures” anywhere.

Ciao
Hannes

From: Suit [mailto:[email-masked]] On Behalf Of Suhas Nandakumar
Sent: 23 November 2017 00:44
To: [email-masked]
Subject: [Suit] SUIT Charter: Multisource signed manifest and permission model

Hi All,

The current charter says the following about allowing manifest and firmware signed by different sources and having an expressive permissions model.

"""

To support a wide range of deployment scenarios, the formats are expected to be expressive enough to allow the use of different software sources and permission models.

"""

I think the whole idea of multiple people signing is very unclear on the requirements and its applicability or its widespread use. Most common deployments today follow the model of single vendor signing the firmware. A certification lab might certify that a given version meets some requirements and and an operator might use that information to decide what version they deploy but neither the certification lab or the operator sign anything.

I propose that the WG should reconsider this requirement for scoping purposes and should consider multi-vendor signing/permissions model  as a future extension instead. This should be removed unless we can specify what the need is and be clear on the trust models supported.

Cheers
Suhas Nandakumar
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.