[Suit] Re: AD Review of draft-ietf-suit-report

[Deb Cooley <[e-mail]>]

Thanks, I've added that link to the ballot text (one of those little blue
buttons on the datatracker page, just above the text of the draft).

Deb

On Tue, Jul 29, 2025 at 3:41 PM Akira Tsukamoto | OPENCHIP <
[e-mail]> wrote:

> Hi,
>
> This is the link to Brendan's email for requesting the media type.
>
> > From: Brendan Moran <[e-mail]>
> > Sent: Tuesday, July 29, 2025 17:54
> > Subject: [Suit] Re: AD Review of draft-ietf-suit-report
>
> > Done!
>
>
> https://mailarchive.ietf.org/arch/msg/media-types/XD43HgujKKcjXqKp7Mj_meSFatw/
>
> > On Mon, Jul 28, 2025 at 6:00 PM Deb Cooley <[e-mail]> wrote:
> > >
> > > Also, get that media type registration submitted.  It is a long lead
> time item!
>
> Akira
>
> ------------------------------
> *From:* Brendan Moran <[e-mail]>
> *Sent:* Tuesday, July 29, 2025 17:54
> *To:* Deb Cooley <[e-mail]>
> *Cc:* Brendan Moran <[e-mail]>;
> [e-mail] <
> [e-mail]>; [e-mail] <
> [e-mail]>; [e-mail] <[e-mail]>
> *Subject:* [Suit] Re: AD Review of draft-ietf-suit-report
>
> Done!
>
> On Mon, Jul 28, 2025 at 6:00 PM Deb Cooley <[e-mail]> wrote:
> >
> > Also, get that media type registration submitted.  It is a long lead
> time item!
> >
> > Deb
> >
> > On Mon, Jul 28, 2025 at 12:56 PM Deb Cooley <[e-mail]>
> wrote:
> >>
> >> Much better.  TY
> >>
> >> Nits.  No need to update these now, just do it before I submit for the
> telechat.
> >> Abstract:  describes/specifies
> >> Section 3, para 5ish:  non condition/non-condition (pick one and stick
> with it, I don't care which).
> >> Section 3, para 5idh:  'communicated to the developer.'  add 'via the
> SUIT_Record.  (for clarity)
> >> Section 4, para 1, sentence 2:  decisiosn/decisions.
> >> Section 4.1:  suit-report-records/SUIT_Report_Records (both case and
> -/_ issues, or is this a cbor thing?)
> >> Section 5:  I think Henk's corim draft has now been adopted (good, I
> don't love referencing individual drafts).
> >>
> >> IETF Last Call might be 3 weeks...we will see.
> >>
> >> Deb
> >>
> >>
> >> On Tue, Jul 8, 2025 at 11:33 AM Brendan Moran <[e-mail]>
> wrote:
> >>>
> >>> Hi Deb,
> >>>
> >>> I believe that the most recent draft addresses all of these comments.
> >>>
> >>>
> >>>
> >>> I’ve made comments inline, marked with [BM]
> >>>
> >>>
> >>>
> >>> It looks like I missed some of these in the draft submitted yesterday.
> That is corrected in
> https://eur06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fsuit-wg%2Fsuit-report%2Fpull%2F59&data=05%7C02%7Cakira.tsukamoto%40openchip.com%7Cdfb48e7aaf084f000c1708ddceb8497b%7Cdfdd4affe2c94e1a86427f6cc6bbbe6d%7C0%7C0%7C638894013121374152%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=Hix4CwBNa%2Fa2KmCQhxaSor6MvPkp%2BXybM%2FYdFaahcjY%3D&reserved=0
> <https://github.com/suit-wg/suit-report/pull/59>
> >>>
> >>>
> >>>
> >>> Best Regards,
> >>>
> >>> Brendan
> >>>
> >>>
> >>>
> >>> From: Deb Cooley <[e-mail]>
> >>> Date: Monday, 24 March 2025 at 17:08
> >>> To: [e-mail] <
> [e-mail]>
> >>> Cc: [e-mail] <[e-mail]>, [e-mail] <
> [e-mail]>
> >>> Subject: [Suit] AD Review of draft-ietf-suit-report
> >>>
> >>> Apologies for the delay, it is hard to do draft review during meeting
> week.
> >>>
> >>>
> >>>
> >>> Thank you to the authors for this work.  It is going to seem like I
> have a lot of comments, but most should be easy to resolve.
> >>>
> >>>
> >>>
> >>> A general comment (but not one that has to be addressed here):  Once
> again, I don't see a lot of working group review of this draft.  The result
> of that is a draft that needs a bit of work to make it coherent and
> understandable.
> >>>
> >>>
> >>>
> >>> General:  Please address the early review comments by IANA (message
> sent to authors on 12 Mar).
> >>>
> >>>
> >>>
> >>> [BM] Done.
> >>>
> >>>
> >>>
> >>> General:  Please fix the lines that are too long  (11 instances).  And
> check the 2 instances of 'non-ascii' characters - they may be erroneous,
> but I would like that confirmed.
> >>>
> >>> [BM]  Resolved.
> >>>
> >>>
> >>> General:  Please check the cddl, or tell me who did the validation of
> this.
> >>>
> >>> [BM] CDDL is now checked automatically when the specification is
> generated.
> >>> See here:
> https://eur06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fsuit-wg%2Fsuit-report%2Fcommit%2F98758ae28e3cc8223521c7c8b46ad99bd5cb9466&data=05%7C02%7Cakira.tsukamoto%40openchip.com%7Cdfb48e7aaf084f000c1708ddceb8497b%7Cdfdd4affe2c94e1a86427f6cc6bbbe6d%7C0%7C0%7C638894013121411827%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=ohYOKIYf15tnY12LNMOOonVLXJMV1E4gG%2Bn%2Bh4i3LVs%3D&reserved=0
> <https://github.com/suit-wg/suit-report/commit/98758ae28e3cc8223521c7c8b46ad99bd5cb9466>
> >>>
> >>>
> >>> Abstract: Remove the last sentence of the first paragraph.  Collapse
> the rest into a single paragraph
> >>>
> >>> [BM] Done
> >>>
> >>> .
> >>>
> >>> Introduction:  Burying the lead...  Add this sentence/paragraph to the
> beginning of the section, 'This specification describes a SUIT-specific
> logging container that creates a lightweight feedback mechanism for
> developers in the event that an update or boot fails in the manifest
> processor.'  [Or something similar (I cobbled together sentences from the
> original abstract and the end of the Introduction.]
> >>>
> >>> [BM] Done
> >>>
> >>>
> >>>
> >>> Introduction, last sentence:  remove this (obviously).
> >>>
> >>> [BM] Done
> >>>
> >>>
> >>>
> >>> Section 3, first para:  remove 'can be assumed to have'  and make it
> 'has' (If the developer has a copy).
> >>>
> >>> [BM] Done
> >>>
> >>> Section 3, 4th para (before second set of bullets):  remove 'Then' and
> 'all'  (To reconstruct the flow of a manifest a developer needs....)
> >>>
> >>> [BM] Done
> >>>
> >>>
> >>>
> >>> Section 3, after second set of bullets:  remove the word 'simply'.
> >>>
> >>> [BM] Done
> >>>
> >>>
> >>>
> >>> Section 3, 'Since it is possible...' para, first sentence: included in
> what?  the logging container?
> >>>
> >>> [BM] The current section is “The SUIT_Record,” thus this is the target
> of the section. The explanation is expanded below:
> >>>
> >>> Since it is possible that a non-condition command (directive) may fail
> in an exceptional circumstance, a failure code for a non condition command
> must be included as well.
> >>>
> >>>
> >>>
> >>> Section 3, 'Since it is possible...' para, third sentence:  is added
> to what?
> >>>
> >>> [BM] Explained that non-condition error codes are added to the
> SUIT_Report, rather than the SUIT_Record, which is the topic of the current
> section.
> >>>
> >>>
> >>>
> >>> Section 3, 'Reconstructing...:  This doesn't hang together.
> Reconstruction isn't compact.  Maybe the format for the reports in the
> logging container used for reconstruction is compact?  Maybe 'The
> reconstruction takes some effort, aided by reports that are compact'?  I
> also don't love the last sentence. Maybe 'Improved tooling can help to make
> the reconstruction easier'?
> >>>
> >>> [BM] Reworded the section:
> >>>
> >>> This approach effectively compacts the log of operations taken using
> the SUIT Manifest as a dictionary. This enables a full reconstruction of
> the log using a matching decompaction tool.
> >>>
> >>>
> >>>
> >>> Section 3, example:  I'm not sure calling the dependencies A, B and C
> helps when they are actually integers.  I would use the real (example)
> integers A=0, B=1, C=2.  At this point, you might not have to explain the
> terminology below this.  (and if Root is [0,0] then put that in too)
> >>>
> >>> [BM] redefined manifest names to clarify
> >>>
> >>>
> >>>
> >>> Section 4:  Define what a SUIT_Report is.
> >>>
> >>> [BM] I wasn’t happy with what was in the published version; this is
> corrected in the PR referenced above.
> >>>
> >>> Section 4, para 2:  This doesn't appear to display properly. It is not
> the way the rest of the CDDL is displayed in this draft.  Is this what you
> intended?
> >>>
> >>> [BM] Fixed
> >>>
> >>>
> >>>
> >>> Section 4, para 3:  What is the consequence of not following the
> SHOULD?  Or is this a MUST in disguise?
> >>>
> >>> [BM] Fixed
> >>>
> >>>
> >>>
> >>> Section 4, last para:  Is the suit-report-nonce missing from the CDDL
> above?
> >>>
> >>> [BM] Fixed
> >>>
> >>>
> >>>
> >>> Section 4.1:  How is this SUIT Record different from the Section 3
> SUIT Record?  Is it a typo and it should be 'Suit Report Record'?  Or are
> they the same?  If they are the same, then the organization of this
> seems....odd.
> >>>
> >>> [BM] This is a list of records, not a single one.
> >>>
> >>>
> >>>
> >>> Section 4.1, para 1 and 2: Why is it 'SUIT Records' sometimes and
> 'SUIT_Records' other times?  Same for 'SUIT Report' and 'SUIT_Report' Are
> they different?  How?
> >>>
> >>> [BM] Fixed.
> >>>
> >>>
> >>>
> >>> Section 5:  This is the first time 'verifier' is mentioned in the
> draft.  How is 'verifier' different than 'recipient'?
> >>>
> >>> [BM] Fixed
> >>>
> >>>
> >>>
> >>> Section 5, para 1: You might need to start with how/why attestation
> applies to SUIT Report.  There are a couple uses of 'this document' in this
> paragraph. Is that meant to be a report?  Or does it refer to this draft
> (also a document)?.  Is attestation data included in a SUIT_Report, and
> why?  I would also separate the EAT information into a separate paragraph
> (like the CoRIM information).
> >>>
> >>> [BM] Fixed
> >>>
> >>>
> >>>
> >>> Section 5, para 1:  This is the first mention of an 'append-only
> log'.  Is this the report format?  Or something else?  What is the 'remote
> device'?  The recipient?  developer?  something else?
> >>>
> >>> [BM] I wasn’t happy with the published version here either. The PR has
> an update.
> >>>
> >>>
> >>>
> >>> Section 8, after bullets:  In which case? There are three options, no?
> >>>
> >>> [BM] Fixed
> >>>
> >>>
> >>>
> >>> Section 10, para 2:  remove 'over-'.  Any reporting of crypo primitive
> failures gives an attacker more information.
> >>>
> >>> [BM] Fixed
> >>>
> >>>
> >>>
> >>> Section 10, para 3, last sentence:  This means that the SUIT_Report
> needs to be seperately encrypted even if the transport is encrypted?  If
> so, add the word 'independently' (the SUIT_Report MUST be independently
> encrypted....).
> >>>
> >>> [BM] Fixed
> >>>
> >>>
> >>>
> >>>
> >>> Nits:
> >>> Section 4, para 1:  occured/occurred.
> >>> Section 4, para 3:  uri/URI
> >>> Section 4.1, para 2:  System properties or System Properties.  Pick
> one.
> >>> Section 5, para 2:  missing ')'
> >>> Section 7:  measres?  Add '(measurement results)' to this.
> >>> Section 8:  spell out 'LwM2M' and 'CoAP' (or give a ref).
> >>> Section 9:  'coap' or 'CoAP' - pick one.
> >>>
> >>> [BM] Fixed (except for System Properties, which is fixed in the PR)
> >>>
> >>> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
>
> _______________________________________________
> Suit mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>
>
> Aquest missatge i qualsevol arxiu adjunt a aquest correu electrònic són
> confidencials i estan destinats exclusivament per a la lectura i ús de
> l'individu o entitat a la qual van dirigits. L'accés a aquest missatge per
> altres persones no està autoritzat. Si vostè ha rebut aquest missatge per
> error, si us plau notifiqui al remitent immediatament i elimini aquest
> missatge del seu sistema. Està estrictament prohibit copiar, divulgar o
> distribuir aquest missatge o qualsevol part del mateix sense el
> consentiment exprés del remitent. Si el missatge està dirigit a clients o
> col·laboradors de OpenChip, el contingut del missatge s'entén subjecte als
> termes establerts en l'Acord de Confidencialitat subscrit entre les parts.
>
> This message and any attachments to this e-mail are confidential and are
> intended solely for the reading and use of the individual or entity to whom
> they are addressed. Access to this message by anyone else is not
> authorized. If you have received this message in error, please notify the
> sender immediately and delete this message from your system. It is strictly
> prohibited to copy, disclose or distribute this message or any part of it
> without the express consent of the sender. If the message is addressed to
> OpenChip's customers or partners, the content of the message is understood
> to be subject to the terms of the Non-Disclosure Agreement subscribed
> between the parties.
>
> Este mensaje y cualquier archivo adjunto a este correo electrónico son
> confidenciales y están destinados exclusivamente para la lectura y uso del
> individuo o entidad a la que van dirigidos. El acceso a este mensaje por
> otras personas no está autorizado. Si usted ha recibido este mensaje por
> error, por favor notifique al remitente inmediatamente y elimine este
> mensaje de su sistema. Está estrictamente prohibido copiar, divulgar o
> distribuir este mensaje o cualquier parte del mismo sin el consentimiento
> expreso del remitente. Si el mensaje está dirigido a clientes o
> colaboradores de OpenChip, el contenido del mensaje se entiende sujeto a
> los términos establecidos en el Acuerdo de Confidencialidad suscrito entre
> las partes.
>