[Suit] Shepherd review of draft-ietf-suit-firmware-encryption-18

["Waltermire, David A. (Fed)" <[e-mail]>]

I am reviewing draft-ietf-suit-firmware-encryption-18 as the document shepherd.

I have the following comments at this point:

abstract:
- "for encrypting software, firmware, machine learning models, and personalization data by utilizing the IETF SUIT manifest" I believe this text should be a bit more open for future consideration of other types of information that might be contained in the manifest. Sugegst the text be changed to "for encrypting software, firmware, machine learning models, personalization data, and similar information" by utilizing the IETF SUIT manifest".

Section 4:
-  "An implementation claiming conformance with this specification must implement support for these two parameters." I think the "must" should be capitalized here.

Section 6:
- "It must be ensured that the guidelines for random number generation in [RFC8937<https://www.ietf.org/archive/id/draft-ietf-suit-firmware-encryption-18.html#RFC8937>] are followed." I think the "must" should be capitalized here as well.

Section 7.3:
- This might be better to appear in the security considerations section, since this is a security consideration.
- "operations took place" should be "operations take place"

General questions:
- Sections 4 and 5 are limited in normative requirements. The CDDL is effectively the expression of the normative requirements; however, we don't state this. Perhaps we should add some normative text around the use of the TBD19 tag and any other required syntax?
- Has anyone, other than the authors, reviewed the examples for correctness?

Regards,
Dave