[Suit] Remaining items from IESG ballot on draft-ietf-suit-information-model

[Roman Danyliw <[e-mail]>]

Hi!

Thanks for all of the work to address IESG review comments in versions -09 to -11.  My review of -11 again the IESG ballot (https://datatracker.ietf.org/doc/draft-ietf-suit-information-model/ballot/) and existing mailing list conversation shows that it would be helpful to consider these remaining comments:

(1) From Ben Kaduk

Section 2

   Secure time and secure clock refer to a set of requirements on time
   sources.  For local time sources, this primarily means that the clock
   must be monotonically increasing, including across power cycles,
   firmware updates, etc. [...]

But it doesn't have to be anywhere close to an actual reference time
source, just monotonic?

(2) From Ben Kaduk and related comment from Rob Wilton

Section 3.3

   identically named entities from different geographic regions from
   colliding in their customer's infrastructure.  Recommended practice
   is to use [RFC4122] version 5 UUIDs with the vendor's domain name and
   the DNS name space ID.  Other options include type 1 and type 4
   UUIDs.

We should probably pick one of 'version' and 'type' when referring to
the UUID constructions.

(3) From Ben Kaduk

Section 3.21

I'm not entirely sure what unqualified "source" and "destination" are
intended to refer to in the context of loading a firmware image.

(4) From Ben Kaduk
Sections 4.3.16-4.3.20

None of these have "Implemented by" lines.  Should they?

(5) From Eric Vyncke
-- Section 3.1.1 & 3.4.2 & 3.4.4 (and possibly others) --
s/vendorId = UUID5(DNS, "vendor-a.com")/vendorId = UUID5(DNS, "vendor-a.exmaple.com")/

Thanks,
Roman