Neat :)!
In case the Mender folks are here, have you looked into incorporating the concerns addressed bt The Update Framework (TUF) https://theupdateframework.github.io/
In case the Mender folks are here, have you looked into incorporating the concerns addressed bt The Update Framework (TUF) https://theupdateframework.github.io/
Yes, we have looked into it and the nice thing is that TUF seems to be quite easy to add as an additional security layer down the road.
One interesting challenge is downgrade attacks. How do you allow rollback of a bad deployment while disallowing an attacker to deploy an old and vulnerable version?
- rollback attacks -- impossible since all comms are secure, and there are no untrusted mirrors
- freezes -- impossible, because SSL channel must be re-negotiated every time
- mix and match attacks -- nothing to mix+match, mender only does one file (rootfs)
- helps secure mirrors -- mender does not support 3rd party mirrors, so no need to secure them.
You can see it right on the TUF homepage: it claims to replace application, library package and system package managers. This is a lot of work, which requires a lot of complexity, and there is no need at all to pay that price if you do not need to.