Re: [Suit] WG Last Call for draft-ietf-suit-architecture-04

Review of draft-ietf-suit-architecture-04

Overall comments:

In Section 2, the text says "Firmware is the more universal term. Both 
terms are used in this document and are interchangeable." Which is the 
other term you are referring to? It is not stated in the text? Also, the 
working group is called Software Update for Internet of Things (SUIT), 
but the document talks about firmware. It is fine to focus, but wouldn't 
it make sense to add some information on how they are different and what 
exactly this document covers. (I am sure there was discussion on the 
term software vs. firmware. After all, the mailing list was previously 
called Firmware Update (FUD).

Then the documents mentions many requirements about being able to work 
with small parsers, being friendly to broadcast delivery etc. Wouldn't 
it help to also say how this architecture would aid that. I am sure that 
some this would be in the manifest document but it would help to have 
some relation between the requirements and architecture.

Section 7 talks about how this architecture is applicable to existing 
systems, but the document doesn't describe how are firmwares and 
manifests are currently distributed. Even though the charter says "This 
group will focus on defining a firmware update solution (taking into 
account past learnings from RFC 4108 and other firmware update 
solutions)", I don't see any text explaining the relationship to current 
mechanisms. I don't expect some long survey of the present deployment, 
but just a few lines explaining how are firmware updates done today, and 
how this architecture is same/different and more light-weight?

Minor suggestions:

Abstract:

The term "solid" is too much of a slang for me. How about robust?

1: Introduction:

I wonder if you would consider adding a reference to 
draft-irtf-t2trg-iot-seccons-16? Perhaps the introduction could begin 
with "As noted in [iot-seccons],  when developing IoT devices, one of 
the most difficult problems to solve is how to update the firmware on 
the device." For full disclosure, I am an author of that document. But I 
do think it makes sense to have it as a reference.

2: Conventions and Terminology

"The manifest is protected against modification and provides information 
about the author." The entity author is defined later. Perhaps this 
sentence could be made self-contained by rephrasing as "The manifest is 
protected against modification and provides information about the author 
of the firmware being updated."

For hardware noobs like me, can you please explain the difference 
between ROM and flash memory. The text says that parts of bootloader may 
reside in ROM and in flash memory.

The text says in the beginning of the section "This document uses the 
following terms:" but then never uses terms such as HoSA/HeSA in the 
rest of the document? Are they needed?

"For example, in some cases, the Original Design Manufacturer (ODM)," 
This is a new term for me (and hopefully for some others). I am more 
used to the term Original Equipment Manufacturer (OEM). Are they different?

3: Requirements

" End-to-end security between the author and the device". For me 
end-to-end security is between machines/devices. Shouldn't it be 
end-to-end security between the firmware server and the device?

This sentence could be re-phrased "One way to achieve this functionality 
is to provide a minimum of two storage locations for firmware and one 
bootable  location for firmware"

Spelling and typos:

Section 2:

succesfully vs successfully

interchangably vs interchangeably

Section 8:

implemention-specific vs implementation-specific

Figure 5 caption "Firmware Upate" vs "Firmware Update"

There are multiple uses of British English: "authorisation", etc. I 
don't have any opinion on this and leave it to the authors and the RFC 
editor.

--Mohit

On 3/27/19 11:03 AM, Russ Housley wrote:
> This is the SUIT WG Last Call for "A Firmware Update Architecture for Internet of Things Devices” <draft-ietf-suit-architecture-04>.  Please review the document and send your comments to the list by 13 April 2019.
>
> The datatracker page for the document is https://datatracker.ietf.org/doc/draft-ietf-suit-architecture/
>
> Thanks,
> Russ & Dave & Dave
>
> _______________________________________________
> Suit mailing list
> Suit@ietf.org
> https://www.ietf.org/mailman/listinfo/suit