Session Date/Time: 07 Nov 2023 16:00

suit

Summary

This SUIT working group meeting focused on progressing the existing working group documents towards completion and IETF last call. Discussions centered around addressing open issues and incorporating feedback from previous reviews and hackathons. Key topics included the SUIT manifest format, trust domains, update management, firmware encryption, report format, and MTI profiles. There were also leadership transitions announced, with thanks given to outgoing chairs.

Key Discussion Points

SUIT Manifest Format: Removing guidelines on deferring signature verification and adding internationalization support for text. Discussion on mapping security requirements from the information model to the manifest.
SUIT Trust Domains: Review of delegation chains using CWTs; need for feedback from the working group.
SUIT Update Management: Addressing an open issue regarding the "should" requirement for a fourth integer in version numbers, potentially violating SemVer.
SUIT Firmware Encryption: Updates on recent drafts, implementations, and open issues, including the removal of position-independent code discussion and moving it to an informative section or appendix.
SUIT Report: Discussion on error codes, whether they are primarily for interoperability or debugging, and whether a limited set of SUIT-specific errors should be defined. Suggestion to encrypt the suit reports.
SUIT MTI: Updates to support TIP (formerly Teep), adding a new profile, and considerations for PQC AAD profiles in the future.

Decisions and Action Items

Hannes: Review the SUIT Trust Domains document and provide feedback to the list by Saturday.
David Brown: Update the SUIT Update Management document to address the SemVer issue and remove the "should" requirement for a fourth integer in the version number.
Brendan: Post an updated SUIT Manifest Format draft (version 25) that includes mapping security requirements from the information model to the manifest and correcting the V24 examples (Target date: end of November/beginning of December).
Brendan: Remove mention of position independent code for Flash Memory from Firmware Encryption
Brendan: Update SUIT Report document to:
- Add a security consideration recommending encryption when generating SUIT reports that contain details.
- Define a limited subset of SUIT-specific error codes.
- Clarify the correct way to specify supported algorithms in the SUIT report on the mailing list.
Chairs: Initiate working group last call for the SUIT Report after the next version is published.
Russ: Serve as the document shepherd for the SUIT MTI document.

Next Steps

Implement the action items above and publish updated drafts.
Continue discussions on the mailing lists.
Paul and Roman will find a co-chair to work alongside Dave Waltermeyer before IETF 119.