[secdir] Re: [Last-Call] draft-ietf-scitt-architecture-20 ietf last call Secdir review

[Henk Birkholz <[e-mail]>]

Hi Chris,

thank you for your feedback! We agree with your summary.


While your review says "Ready", though, it also says "with nits" in one 
place? Is that "with nits" a nit? If so, we'll move on with a "Ready" - 
but well wait for your feedback.


Viele Grüße,

Henk

On 10.09.25 13:20, Chris Lonvick via Datatracker wrote:
> Document: draft-ietf-scitt-architecture
> Title: An Architecture for Trustworthy and Transparent Digital Supply Chains
> Reviewer: Chris Lonvick
> Review result: Ready
> 
> Hi,
> 
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG. These comments
> were written primarily for the benefit of the security area directors. Document
> editors and WG chairs should treat these comments just like any other last call
> comments.
> 
> The summary of the review is READY (with nits).
> 
> It is clear that the authors, contributors, and the Working Group have
> extensively discussed this and have arrived at consensus for this document. My
> compliments to them for pulling together a single document that covers such a
> large concept.
> 
> I am not familiar with the workings of supply chains to be able to provide a
> comprehensive review. However, I found the Shepherd's writeup to be very
> helpful. I believe that I can't add anything more useful than what was written
> there concerning discussions around security. For convenience, I'll post it
> here:
> 
> There was a substantial amount of discussion around Security, some of which
> were resolved by using a known signing format with provision for agility
> (COSE). Discussion took place around steps that service operators could take to
> secure their instances, and converged on a clear, minimal text. The definition
> of the bytes to be signed was discussed extensively, and the tradeoffs and
> benefits of including unprotected headers weighed at length, before consensus
> was reached. Statement identification and references were also discussed, but
> consensus could not be reached, and it was agreed that it may be addressed in a
> separate, later document.
> 
> I agree that it is ready to be handed off to the responsible Area Director.
> 
> Best regards,
> Chris
> 
>