Add initial version of Feature Request for Crypto & Security in docs. #1490

marcmo · 2025-07-23T12:50:43Z

originates from CR #132926
closes #905

github-actions · 2025-07-23T13:24:29Z

The created documentation from the pull request is available at: docu-html

TomFleischmann · 2025-07-31T09:43:50Z

docs/features/security_crypto/index.rst

+* The cryptographic subsystem should be aware that certain attacks will try to observe the overall
+  system to analyze its inner workings to guess secrets (side channel/timing attacks) or to influence
+  it to limit its availability for system critical tasks.
+


HW separation to specify what is done in S-CORE and what in a TEE/HSW/Hardware and many supported by the OS as well. To be detailed.
Think if combination of key mangmt and cert mngmt possible.
Potentially del line 72

TomFleischmann · 2025-07-31T09:46:26Z

docs/features/security_crypto/index.rst

+
+* The cryptographic subsystem typically needs to 'rely on hardware acceleration' to execute operations
+  efficiently or to access a TRNG (True random number generator) for entropy. Additionally, it MAY be a
+  good idea to as well have a software-only solution.


Considering PQC and using SW for that if the HW may not support it.

TomFleischmann · 2025-07-31T09:48:29Z

docs/features/security_crypto/index.rst

+  to ensure it is protected (memory, CPU) from applications and the normal operating system while still offering its functionality to
+  applications and middleware services.
+* 'Time' in the sense of real world wall clock is crucial for the cryptographic subsystem to ensure
+  that for example a certificate or token is only used within its validity period.


Integrity of time should be an additional requirement (e.g. signed by a backend and verified on S-CORE).

TomFleischmann · 2025-07-31T09:49:41Z

docs/features/security_crypto/index.rst

+* The cryptographic subsystem typically needs to 'rely on hardware acceleration' to execute operations
+  efficiently or to access a TRNG (True random number generator) for entropy. Additionally, it MAY be a
+  good idea to as well have a software-only solution.
+* Will use system level means (co-processor, hardware security module, Trusted Execution Environment, ...)


Add that we want to rely on HW as primary computational resource and add as well a SW algorithm if the HW does not support specific cases)

TomFleischmann · 2025-07-31T09:51:38Z

docs/features/security_crypto/index.rst

+           |
+           |
+  |------------------|
+  |    KeyStore      |


Local in-device key generation and derivate strategies is still missing and should be considered.

TomFleischmann · 2025-07-31T09:55:26Z

docs/features/security_crypto/index.rst

+           | --> Signature (create / verify)
+           | --> Symmmetic crypto (encrypt, decrypt)
+           | --> KeyMngmt (generate, import, update, delete, check)
+           | --> CertificateManagement (add, update, verify)


Certificates could be protected by means of filesystem OS protection means and ACLs.

TomFleischmann · 2025-07-31T09:59:36Z

docs/features/security_crypto/index.rst

+* Key exchange (ECDH)
+* Hashing (SHA-2, SHA-3, BLAKE3)
+* Random number generation (ChaCha20Rng)
+


Potentially missing here are RSA for a-sym, EDDSA, MLDSA, SLDSA.

Need maybe a stakeholder requirement for other markets, e.g. China.

TomFleischmann · 2025-07-31T10:04:33Z

docs/features/security_crypto/index.rst

+
+Finally the security subsystem needs to consider the production scenario where potentially several
+'initial production keys' are brought into the system.
+


ACL for the APIs - add this as well. (manifest, whitelist/blacklist)

Security Concept, Assumptions of Use must be defined

TomFleischmann · 2025-07-31T10:07:08Z

docs/features/security_crypto/index.rst

+Following the white house cybersecurity plan and other industry voices to improve robustness of
+critical systems by using memory safe languages S-CORE decided to have Rust as a 1st class
+citizen. The security subsystem SHALL be developed entirely in Rust.
+


Compatibility with existing and already hardened libraries in C++.
In general I admit the feature request is not the place to take a design decision right here.

TomFleischmann · 2025-07-31T10:13:22Z

docs/features/security_crypto/index.rst

+* Trusted computing environmeent / HSM
+* Roles and capability rights management
+* Connection to IDS / anomaly detection
+* Zero trust - BS or where to use ?


Defense in depth, least right privilege;

Assumptions of use of the overall system not being directly exposed to the internet but behind further security controls.

TomFleischmann · 2025-07-31T10:14:54Z

docs/features/security_crypto/index.rst

+* OS security mechanisms
+* Trusted computing environmeent / HSM
+* Roles and capability rights management
+* Connection to IDS / anomaly detection


Check with UNECE 155.

Potentially add that a tamper proof-able or tamper-detetable log/journal is in used.

Time budget, observation and process observation.

Better to check here
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160v1r1.pdf
Appendix E. Principles for Trustworthy Secure Design ...

TomFleischmann · 2025-07-31T10:21:57Z

docs/features/security_crypto/index.rst

+
+Post quantum readiness
+----------------------
+


Latest version of WolfSSL, latest version and OpenSSL,v 3.5 already have support here.

TomFleischmann · 2025-07-31T10:24:25Z

docs/features/security_crypto/index.rst

+Due to the nature of our overall system to be deployed for 10+ years in an embedded systems
+such a security plan needs to as well cover 'software-update strategy', 'field observation', 'crypto
+algorithm updates', 'repairability', and 'whitstand reverse engineering of secrets'.
+


Use "best practices" and follow industry standards like ISO21434.

HartmannNico · 2025-08-04T12:21:29Z

From the Architecture Meeting 2025/08/04: Feature requirements are mandatory to merge this FR

…score#1689)

Signed-off-by: Alexandru Iulian <iulian.alexandru@continental-corporation.com>

* Removed the first line of teaser under Introduction This links to duplicate and outdated contents. Additionally removed the entries from the top navigation bar leading to introduction and how to contribute * Perform forwarding to marketing website Added Contribute back into the TOC Added hidden TOC entry for introduction page to enable forwarding.

Signed-off-by: aschemmel-tech <aschemmel_job@arcor.de>

update to reflect changes in process description eclipse-score/process_description#167 and eclipse-score/process_description#148 Resolves: eclipse-score#1310 Change-Id: I6a58c1f0c457c654230e01ffb30a179b1729bcf4

….0 (eclipse-score#1796)

Process Community is responsible for ISSUE_TEMPLATES Change-Id: I757c4c1672cbc3c05fab0568072bb2fcdad623cb

Fix dac version check issue on merge to main. Version check should run only on PR. Signed-off-by: Nicolae Dicu <nicolae.dicu.ext@qorix.ai>

Display a warning message in PR that docs might not be displayed properly if gh-pages size > 950MB. Signed-off-by: Nicolae Dicu <nicolae.dicu.ext@qorix.ai>

remove security plan, rephrasing security concept add security/safety impact remvove MAY requirements for RUST, is already staekholder requirement

…ates

TomFleischmann added the feature_request label Jul 23, 2025

TomFleischmann mentioned this pull request Jul 23, 2025

Feature Request for Security & Crypto #905

Open

TomFleischmann reviewed Jul 31, 2025

View reviewed changes

TomFleischmann requested review from a team, AlexanderLanin, FScholPer, MaximilianSoerenPollak, PhilipPartsch, antonkri, aschemmel-tech, dcalavrezo-qorix, johannes-esr, markert-r, masc2023, pahmann and qor-lb as code owners August 28, 2025 10:24

AlexanderLanin and others added 30 commits October 8, 2025 09:00

DR-002-Infra: Integration Testing in a Distributed Monolith (eclipse-…

c055cc6

…score#1689)

Revert "autosd feature docs"

5706dcf

json-lib: Add write requirement for JSON lib

821f6e5

Signed-off-by: Alexandru Iulian <iulian.alexandru@continental-corporation.com>

CODEOWNERS - correct and update

058246c

Signed-off-by: aschemmel-tech <aschemmel_job@arcor.de>

Committing Base Libs Architecture

11f602c

add forking guide (eclipse-score#1731)

6f4d837

update change management plan

be9de85

update to reflect changes in process description eclipse-score/process_description#167 and eclipse-score/process_description#148 Resolves: eclipse-score#1310 Change-Id: I6a58c1f0c457c654230e01ffb30a179b1729bcf4

bump version to 0.4.0 and update score_docs_as_code dependency to 1.3…

10f7e6d

….0 (eclipse-score#1796)

update CODEOWNER

d8130c6

Process Community is responsible for ISSUE_TEMPLATES Change-Id: I757c4c1672cbc3c05fab0568072bb2fcdad623cb

ci: Check Docs-as-Code version consistency (eclipse-score#1802)

4320c98

added additional requirements

5d0dcc8

fixed wrong ids

e348597

changed stackholder requirements

820ecb5

improve DR-002 executive summary (eclipse-score#1799)

06ff494

ci: fix docs workflow (eclipse-score#1819)

509fc7a

Fix dac version check issue on merge to main. Version check should run only on PR. Signed-off-by: Nicolae Dicu <nicolae.dicu.ext@qorix.ai>

ci: Warn on gh-pages branch size (eclipse-score#1834)

15a2da8

Display a warning message in PR that docs might not be displayed properly if gh-pages size > 950MB. Signed-off-by: Nicolae Dicu <nicolae.dicu.ext@qorix.ai>

update dokumentaton management plan

9b9dc07

update safety management plan with links to document management plan

1711973

bugfix reference link

44e7b33

Include review findings.

068840e

include review findings

80f873c

include review findings

580c307

Change module.bazel

a11d944

rework the section of work packages types

aaf5743

Add minimal Component Architecture for Result library

7e5c115

updating feature request

f4e7fa4

remove security plan, rephrasing security concept add security/safety impact remvove MAY requirements for RUST, is already staekholder requirement

Added requirement for performance benchmark

d176847

updating feature request

0eb9e44

remove security plan, rephrasing security concept add security/safety impact remvove MAY requirements for RUST, is already staekholder requirement

Merge branch 'cr-132926' of https://github.com/esrlabs/score into upd…

1dee5bc

…ates


		Finally the security subsystem needs to consider the production scenario where potentially several
		'initial production keys' are brought into the system.


		Post quantum readiness
		----------------------

Add initial version of Feature Request for Crypto & Security in docs. #1490

Are you sure you want to change the base?

Add initial version of Feature Request for Crypto & Security in docs. #1490

Uh oh!

Conversation

marcmo commented Jul 23, 2025 • edited by qor-lb Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jul 23, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

HartmannNico commented Aug 4, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

23 participants

marcmo commented Jul 23, 2025 •

edited by qor-lb

Loading