[appsdir] Scan of draft-ietf-straw-b2bua-dtls-srtp-00.txt

["Orit Levin (LCA)" <[e-mail]>]

This is a short (7 pages) draft.
The proposed status is a "Standards Track" although, in essence,  it is a list of guidelines based on mechanisms defined in existing RFCs or drafts.

The "recommendations/guidelines" are arranged in three groups - each applicable to a different "type" of a SIP B2B media relay:

-        media non-aware

-        media aware with header inspection only (and no payload inspection/modification)

-        media aware with headers modification (and no payload inspection/modification)


While the use cases  behind each of the technical approaches might be well-known, the motivation behind "standardizing" each one separately (with a different set of MUSTs & SHOULDs!) is not clear to me.

The Security Considerations section reads as a "placeholder" at this time, although the whole document is about security and privacy considerations.

Most of the Informative References need to be Normative; this is especially important for rfc4474bis and jones-avtcore drafts that are in the core of the guidelines.

A few more specific comments:

Section 3.3 the paragraph before the last
"... MUST ensure that it does not modify any of the headers used to construct the signature." It would be helpful to actually analyze the provided references and compile a list of headers that the relay MUST NOT modify.

Section 3.2.2
"This security and privacy problem can be addressed by ... as discussed in [I-D.jones-avtcore-private-media-reqts],..."
This needs to be (re)phrased as a normative statement.

Orit.