Re: Access control for IoT

32 KibiBytes are actually plenty, if you are willing to forego the
usual bloat of compiled C (or such) code and use Forth.

A crypto vocabulary (read library) that does AES, SHA256, RSA or ECC
would be max
8 KibiBytes in compile Forth definitions, I think.

Access control can be done by macaroons (though the expressability of
the caveats will be limited somewhat)

The RSA/ECC would only be used for sign verification of relatively
infrequent firmware updates. (Relativly, that is, to sensor and
actuation messages)

On 18 January 2016 at 21:07, Tony Arcieri <[email protected]> wrote:
> On Mon, Jan 18, 2016 at 11:59 AM, Valerio Bellizzomi <[email protected]>
> wrote:
>>
>> I've seen software update is a process that needs the device powered off
>> and on some devices the reflashing is via usb cable.
>
>
> I consider automatic software updates a baseline requirement for a secure
> system. If the device needs to be connected to some sort of tether cable and
> flashed by some 3rd party software utility the user needs to install, those
> upgrades aren't going to happen.
>
>>
>> It depends, if there is a full OS, it can do updates via remote link.
>
>
> An full OS is not a requirement for remote upgradability. However, the only
> systems I know for doing this in a manner I'd consider secure are
> proprietary.
>
> --
> Tony Arcieri
>
> _______________________________________________
> cap-talk mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/cap-talk
>