SW Dev Process Community - S-CORE Security Team - Meeting Minutes

[masc2023]

Meetings Minutes of S-CORE Security Team.

[masc2023]

Nov-28, 11-12 o'clock

Agenda:
Introduction
Check participants
Align on Agenda for today

Scope Definition
Status of ISO/SAE 21434 compliance

Participants:
Werner Schreiber (Schaeffler), @schreibw-sag
@thilo-schmitt (MB)
Athul Mallappallil (ETAS), @ChansAlive
@odra
Martin Mager
@pahmann (ETAS)
@NarasipurRohini (MB)
Sunil (ETAS), @sunildevda
@PandaeDo
@masc2023

Meeting Minutes:
Short introduction of the Community, Structure, Hint to https://eclipse-score.github.io/process_description/main/workproducts/index.html#wp__policies

Record new participants, Short introduction round

Define Scope of the working group

1. Technical aspects security related, Features, Module, (Requirements, Architecture, Analysis, Verification/Tests) ->Security Engineer
2. Process, Compliance topics
3. Tools, Infrastructure, Evaluation, Vulnerability Monitoring, SBOM
4. Driving Awareness, Following-up Security Issues -> Security Manager

Put on the next agenda: #1889

Status of ISO/SAE 21434 compliance, explained

[masc2023]

Dec-05, 11-12 o'clock

Agenda:
Check participants
Align on Agenda for today
Short overview over Planning
Discuss Security Analysis, levels, who can propose methods, starting asset definition?
Put on the next agenda: #1889

Participants:
@sunildevda
@odra
@NarasipurRohini
@PandaeDo
@CryptoNutcase
@ChansAlive

Meeting Minutes:
Short explanation of the planning strategy
Went through the questions of Sunil, will be continued in another meeting

[sunildevda]

@masc2023 For today's sync meeting we would like to discuss following points.

Point 1: Clarification regarding technical requirements.
We would like to get some information on the following requirements. Basically to understand the use case and motivation. 0

1. General understanding of the scope of these requirements. are all these requirements only for cryptography? some looks to be generic and system wide.
2. Side-Channel Attack Mitigation: In our understanding side channel attacks are more relevant for HSM/TEE implementation. How and what shall be done in the middleware? Moreover, we need to break this requirement into more clear requirement, in the current form it is not testable. (how can we be sure that we have the necessary measures that is expected for the side channel attacks?)
3. Security concept: are these requirements only for Cryptography or overall security of the middle-ware.
4. Crypto Algorithm Update Strategy: Use case and motivation please.
5. Reverse Engineering Protection: More details please. what exactly needs to be done?
6. Software Fallback: What is meant by Fallback? in our understanding, we should have the possibility to support both hardware and software cryptography. and the application can choose which one to use based on the system architect and use case. the word Fallback is confusing.
7. Trusted Time Source: Who maintains and provides trusted time source? Why should Crypto access this time source? The time source should be directly be set in the system and Crypto directly accesses the system time.
8. Initial Production Key Handling: More details please. does this mean we have to functionalities like importing/exporting/updating crypto material via crypto stack or is it that they materials are already provisioned by other means and the crypto stack has to use these materials?
9. Denial-of-Service (DoS) Mitigation: Use case please. is this for secure communication use case? or other use cases like a malicious application directly using cartography services and giving large data and blocking the access to other applications?

Point 2: Update tool verification report template #432

1. Some background please. Which tools are to be considered here? all tools that is used for development purpose?
2. Is it for the evaluation of other open source tools and/or tools that are developed in score project? example, some configuration tool also in scope?

[masc2023]

Dec-12, 11-12 o'clock

Agenda:
Check participants
Align on Agenda for today
Planning

Participants:
@PandaeDo
@CryptoNutcase
@masc2023
@sunildevda
@thilo-schmitt
@NarasipurRohini

Meeting Minutes:

Last Meeting for this year 19.12.2025, will restart 09.01.2026

Planning discussion

1. Security Analysis, Platform Analysis, @NarasipurRohini, @masc2023 prepare detailed planning, Security Analysis: WF: Analyze Platform process_description#454
2. Roll-out of Platform Analysis, @masc2023 defines planning topic, Security Analysis: Create S-CORE Platform Security Analysis process_description#455
3. Security Analysis, Feature Analysis, Component Analysis, @CryptoNutcase, @masc2023 prepare detailed planning, Security Analysis: WFs: Analyse Feature/Component Architecture process_description#453
4. Roll-out of Feature Analysis, Component Analysis, @masc2023 defines planning topic, Security Analysis: Piloting Create Feature/Component Security Analysis process_description#456
5. Security Management, Create/Maintain Security Plan, @sunildevda, @masc2023 prepare detailed planning, Security Management: WF: Create/Maintain Security Plan process_description#451
6. Roll-out of Security Management Plan in score, @sunildevda, @masc2023 defines planning topic, Update Security Plan and Security Management Plan process_description#452
7. Rework Security Feature Request, compare comments above, @sunildevda, Change: Security & Cryptography #2334
8. Rework high level tailoring for work products, @masc2023, Process Management: Update Tailoring Work Products for Securits process_description#458

@FScholPer , @masc2023 raise again the topic of findings by dependable-bot, bus issue should be resolved, planned, especially for up-coming release, Raise it on next FT/CT Meeting, 15.12.2025

[masc2023]

Dec-19, 11-12 o'clock

Agenda:
Check participants
Align on Agenda for today
Planning

Q&A
Questions for the tickets created?
eclipse-score/process_description#466

Participants:

Meeting Minutes:

Last Meeting for this year 19.12.2025, will restart 09.01.2026