Re: [Suit] Information model updates

[Hannes Tschofenig <[e-mail]>]

Hi Roman,

I just submitted a new version of the draft based on those review comments.

A few notes below:

-----Original Message-----
From: Roman Danyliw <[e-mail]>
Sent: Wednesday, May 26, 2021 4:53 PM
To: Brendan Moran <[e-mail]>
Cc: [e-mail]; [e-mail]
Subject: RE: [Suit] Information model updates

Hi Brendan!

Thanks for all of the work on -12.  I reviewed it against the COMMENTS and think the following minor items should still be clarified:

Benjamin Kaduk

Section 3.3

   identically named entities from different geographic regions from
   colliding in their customer's infrastructure.  Recommended practice
   is to use [RFC4122] version 5 UUIDs with the vendor's domain name and
   the DNS name space ID.  Other options include type 1 and type 4
   UUIDs.

We should probably pick one of 'version' and 'type' when referring to the UUID constructions.

[Roman] I think either we say that versions don't matter or pick one.

[Hannes] I removed the sentence that talks about the other option to avoid confusion.

Section 4.2.11.1

   This is a denial of service because it can render devices inoperable.
   This is an elevation of privilege because it allows the attacker to
   make installation decisions that should be made by the Operator.

In this example it seems like the decision was supposed to have been made by the Network Operator specifically, but perhaps I misunderstand.

[Hannes] In this example, the network operator should have verified the manifest before providing it to the device or having the device perform an additional check to ensure that the respective network operator authorized the installation of the update.

Sections 4.3.16-4.3.20

None of these have "Implemented by" lines.  Should they?

[Hannes] I added text; it looks more consistent.

(Barry Leiba)

- Section 3.3.1 -

   vendorId = UUID5(DNS, "https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fvendor-a.com%2F&amp;data=04%7C01%7Cdthaler%40microsoft.com%7C0e8f56f89d3e45b93d0a08d920560c24%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637576376229033224%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=9XlgjOKUPhi83m4OkH44hf4iV2Hui2jzfxS1eIQpeds%3D&amp;reserved=0")

Please use a BCP 32 domain name reserved for examples in documentation, here and throughout.  I suggest "vendor-a.example" here.

[Hannes] I went through the document and corrected the example DNS name.

Éric Vyncke
-- Section 3.2 --
"A monotonically increasing sequence number" should this number be unsigned ?

[Roman] you already handled the roll-over part of this comment.

[Hannes] I added a note about the rollover.


-- Section 3.1.1 & 3.4.2 & 3.4.4 (and possibly others) -- s/vendorId = UUID5(DNS, "https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fvendor-a.com%2F&amp;data=04%7C01%7Cdthaler%40microsoft.com%7C0e8f56f89d3e45b93d0a08d920560c24%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637576376229033224%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=9XlgjOKUPhi83m4OkH44hf4iV2Hui2jzfxS1eIQpeds%3D&amp;reserved=0")/vendorId = UUID5(DNS, "https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fvendor-a.exmaple.com%2F&amp;data=04%7C01%7Cdthaler%40microsoft.com%7C0e8f56f89d3e45b93d0a08d920560c24%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637576376229033224%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=ut9CepQhKHZTXoOYIyh38QVGsogoFVk6x%2Fk8VEL5TRg%3D&amp;reserved=0")/

Regards,
Roman


From: Brendan Moran <[e-mail]>
Sent: Monday, May 24, 2021 11:30 AM
To: Roman Danyliw <[e-mail]>
Subject: Re: [Suit] Information model updates

Hi Roman,

Yes, this version was supposed to address all IESG comments.

Best Regards,
Brendan


On 24 May 2021, at 16:17, Roman Danyliw <mailto:[e-mail]> wrote:

Hi Brendan!

Thanks for the update.  (Selfishly asking) Is this the version I should review to ensure the IESG comments are done so I can release the doc?

Roman

From: Suit <mailto:[e-mail]> On Behalf Of Brendan Moran
Sent: Monday, May 24, 2021 10:37 AM
To: Russ Housley <mailto:[e-mail]>
Cc: suit <mailto:[e-mail]>
Subject: Re: [Suit] Information model updates

Dear Russ,

Having received no comments on the posted pull requests, I have now merged them and submitted the new draft.
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-suit-information-model%2F&amp;data=04%7C01%7Cdthaler%40microsoft.com%7C0e8f56f89d3e45b93d0a08d920560c24%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637576376229033224%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=qpq74U1i7EU6hkTzA596sKTwTLoz5xOsOh920kRqCGA%3D&amp;reserved=0

Best Regards,
Brendan



On 24 May 2021, at 14:55, Russ Housley <mailto:[e-mail]> wrote:

The IESG is waiting for a revised Internet-Draft to be posted.

Russ



On May 13, 2021, at 6:06 AM, Brendan Moran <mailto:[e-mail]> wrote:

I've made a number of pull requests to the information model. These should address the issues raised by IESG review.

See here for more information: https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fsuit-wg%2Finformation-model%2Fpulls&amp;data=04%7C01%7Cdthaler%40microsoft.com%7C0e8f56f89d3e45b93d0a08d920560c24%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637576376229043217%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=wlktrK7NdR8H6Y0HQQKJpiXw6pl45ELfY8t3lHnqpAs%3D&amp;reserved=0

Brendan
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
_______________________________________________
Suit mailing list
mailto:[e-mail]
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsuit&amp;data=04%7C01%7Cdthaler%40microsoft.com%7C0e8f56f89d3e45b93d0a08d920560c24%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637576376229043217%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=DA8Nq%2BTX7zJUjTKG%2BCIDIZaGdtWFCf15GIdd787UTaM%3D&amp;reserved=0

_______________________________________________
Suit mailing list
mailto:[e-mail]
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fsuit&amp;data=04%7C01%7Cdthaler%40microsoft.com%7C0e8f56f89d3e45b93d0a08d920560c24%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637576376229043217%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=DA8Nq%2BTX7zJUjTKG%2BCIDIZaGdtWFCf15GIdd787UTaM%3D&amp;reserved=0

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.