Subject: [Suit] Genart last call review of draft-ietf-suit-architecture-11

From: Theresa Enghardt via Datatracker <[email-masked]>
Date: Sun, 09 Aug 2020 10:49:37 -0700

Reviewer: Theresa Enghardt
Review result: Almost Ready

I am the assigned Gen-ART reviewer for this draft. The General Area
Review Team (Gen-ART) reviews all IETF documents being processed
by the IESG for the IETF Chair.  Please treat these comments just
like any other last call comments.

For more information, please see the FAQ at

<https://trac.ietf.org/trac/gen/wiki/GenArtfaq>.

Document: draft-ietf-suit-architecture-11
Reviewer: Theresa Enghardt
Review Date: 2020-08-09
IETF LC End Date: 2020-08-14
IESG Telechat date: Not scheduled for a telechat

Summary:

Thank you for this work. This document is clear in the problem that it
addresses and in specifying its approach. I just have a few minor clarification
questions.

Major issues: None.

Minor issues:

Section 1

I find the following paragraph a bit confusing:

"While the standardization work has been informed by and optimised for
   firmware update use cases of Class 1 devices (according to the device
   class definitions in RFC 7228 [RFC7228]), there is nothing in the
   architecture that restricts its use to only these constrained IoT
   devices.  Software update and delivery of arbitrary data, such as
   configuration information and keys, can equally be managed by
   manifests."

The paragraph is about generalizing the work presented in this draft, but the
first sentence suggests that it's about generalizing it to more devices, and
the second sentence talks about different use cases, but indirectly: At this
point, the reader does not yet know that this work is based on manifests, as
this is the first occurence of the word "manifest" in the text. Therefore, it
is not clear that "can be equally managed by manifests" refers to applying the
architecture presented in this draft to other use cases. I suggest to change
the second sentence to something like: "Moreover, this architecture is not
limited to managing software updates, but can also be applied to managing the
delivery of arbitrary data, such as configuration information and keys."

Section 2

Status Tracker: Why does the IoT device itself "most likely not run a status
tracker itself", even as the draft defines client-initiated updates? This
sentence seems unnecessarily restrictive to me.

This section introduces Trusted Execution Environments (TEEs) and points to
draft-ietf-teep-architecture, but is not explicit about the relationship
between SUIT and TEEP. I think it's worth adding one or two sentences
explaining this relationship, i.e., does SUIT require TEEP, does TEEP require
SUIT, do both complement each other but can be implemented independently, ...?

Section 3.5. High reliability

Here maybe it's worth adding another case to protect against, i.e., if the
download is interrupted due to loss of network connectivity or if there's
packet loss. It's not obvious to me where this case is included, as the
"broadcast-friendly" requirement implies that these devices are not necessarily
running TCP or another protocol that provides reliable in-order data delivery.

Section 3.7. Small Parsers

I think it's worth adding that this is about the parser of the manifest (if
this is in fact the case), as this is not obvious from the context.

Section 3.10. Operating modes

This section presents steps a devices has to go through in the course of an
update, while section 5 and section 9 also talk about different steps, and
section 8 has additional steps, e.g., the bootloader has to check the integrity
of a firmware image again before booting it. I think it's worth adding at least
some cross-references, e.g., in Section 3.10, highlight that this is not an
exhaustive list of steps, and that Section 9 has a more complete example
including the the necessary checks.

Section 4. Claims
Why is this its own section? Isn't this just another term for Section 2, and/or
just just another requirement for Section 3?

Section 8. Bootloader

I do not understand the following paragraph:

"If the application image contains the firmware consumer
   functionality, as described above, then it is necessary that a
   working image is left on the device. This allows the bootloader to
   roll back to a working firmware image to execute a firmware download
   if the bootloader itself does not have enough functionality to fetch
   a firmware image plus manifest from a firmware server over the
   Internet."

What is an application image? Is it different from a firmware image?
And why does the firmware download have to be carried out from the bootloader
here (with rollback to a previous image)? Hasn't the firmware already been
downloaded at this point? There's probably some condition under which this
needs to be done - please add it to the text.

Nits/editorial comments:

Section 7.4.  Dual CPU, other bus

"It is likely that one of the CPUs will be considered a master"
s/master/primary/