Reviewer: Haoyu Song Review result: Ready with Issues This review is done as requested by the Internet Area Directorate. Document editors and WG chairs should treat these comments just like any other last-call comments. The document needs an introduction or references to the background and related work pertaining to the problem domain. Without understanding the status quo and the state-of-the-art solutions, it’s difficult to evaluate what the proposed framework has improved and the value of it compared to the existing solutions. More than 30% of the document content is in the appendix. Are these topics considered non-essential and can be ignored? How do the authors plan to treat these materials in the published RFC? P8 “The claims set includes a nonce or some other means to assure freshness.” Should these means be explained in more detail? The concept and mechanisms are not obvious to readers. The document supplies a set of claims and profiles for EAT. As long as EAT is motivated as necessary in real use cases, I don’t see a reason to block the advance of this document. Some editorial suggestions: Acronyms should be spelled out on first use. It’s better to also provide references. This applies to all the acronyms throughout the draft (e.g., TEE, CDDL, COSE, JOSE, ...) P9 “For example, measurements in evidence may be compared to reference values [and?] the results of which are represented as a simple pass/fail in attestation results.” -- last-call mailing list last-call@xxxxxxxx https://www.ietf.org/mailman/listinfo/last-call
