Re: [Suit] WG Last Call for draft-ietf-suit-information-model-03

[Brendan Moran <[e-mail]>]

I have incorporated Dave’s feedback on the changeset linked below. If there is any additional commentary, I would be happy to incorporate it. Otherwise, I will submit the current version as draft-ietf-suit-information-model-04.

Best Regards,
Brendan


> On 21 Oct 2019, at 13:17, Brendan Moran <[e-mail]> wrote:
>
> Hi Dave,
>
> Thank you very much for your review of the information model. I have incorporated your comments and I have added some additional information regarding the end-to-end security model. The changes are in a Pull Request on the suit-wg GitHub:
>
> https://github.com/suit-wg/information-model/pull/4
>
> Input is welcome!
>
> Brendan
>
>> On 21 Aug 2019, at 02:57, Dave Thaler <dthaler=[e-mail]> wrote:
>>
>> My comments on this document are in the marked up PDF copy at
>> https://www.microsoft.com/en-us/research/uploads/prod/2017/05/draft-ietf-suit-information-model-03.pdf
>> Most are simple editorial nits.
>>
>> Other comments include:
>> * The UUID RFC (4122) does not use a "prefix".  Instead it uses namespace IDs, which is what I think the draft is talking about.
>> * Need to address the issue of how UUIDs are "matched".   I recommend saying binary match (regardless of whether they're serialized as strings or 16-octet fields, since serialization is out of scope for this doc).  Point is that it would be a problem if a format serialized as strings and said to compare case insensitively.  This doc is acting as the security requirements/threat model and so needs to state this as the requirement in 3.3 and 3.4.
>> * Various terminology ("root of trust", "firmware authority", etc.) needs updating to be consistent with the arch doc.
>> * Sections 4.2.11 and 4.4.3 are, in my opinion, about a Device Operator role, not a Network Operator role as the text currently says.
>> * Section 4.4.3 is about a network operator but the language needs tweaking to actually apply to that role.
>> * COSE and CMS are only used informatively, not normatively, and so should be moved to the Informative References.
>>
>> See the PDF for the full context and details of my comments above, but that's a quick summary.
>>
>> Dave
>>
>> -----Original Message-----
>> From: Suit <[e-mail]> On Behalf Of Russ Housley
>> Sent: Monday, August 12, 2019 10:30 AM
>> To: suit <[e-mail]>
>> Subject: [Suit] WG Last Call for draft-ietf-suit-information-model-03
>>
>> This is the SUIT WG Last Call for "Firmware Updates for Internet of Things Devices - An Information Model for Manifests” <draft-ietf-suit-information-model-03>.  Please review the document and send your comments to the list by 6 September 2019.  This is longer than usual to accommodate vacation season.
>>
>> The datatracker page for the document is https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-suit-information-model%2F&amp;data=02%7C01%7Cdthaler%40microsoft.com%7C8f95a824d19c4eae363608d71f7565f1%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637012461397594909&amp;sdata=hKlq9oUNqEz5XrOre3mYa8QdCoYshPQIeQqHkMqZH5I%3D&amp;reserved=0
>>
>> Thanks,
>> Russ & Dave & Dave
>>
>> _______________________________________________
>> Suit mailing list
>> [e-mail]
>> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsuit&amp;data=02%7C01%7Cdthaler%40microsoft.com%7C8f95a824d19c4eae363608d71f7565f1%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637012461397594909&amp;sdata=2o48ERtnDJ9ptKvhPWaPNO9pP5C620wEq%2BwpiT5eRbQ%3D&amp;reserved=0
>> _______________________________________________
>> Suit mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/suit
>

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.