[AVTCORE] Roman Danyliw's No Objection on draft-ietf-avtcore-multi-party-rtt-mix-18: (with COMMENT)

[Roman Danyliw via Datatracker <[e-mail]>]

Roman Danyliw has entered the following ballot position for
draft-ietf-avtcore-multi-party-rtt-mix-18: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-avtcore-multi-party-rtt-mix/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you to Rich Salz for the SECDIR review.

** Section 11.  Per “Participants with malicious intentions may appear ...”,
this text seems to be describing an attacker that is party to the call.  If the
mitigations suggested in the next sentence (i.e., secure signaling ... and
authentication) aren’t present, this style of attack may also be possible by an
on-path attacker as might be simple eavesdropping or injection of arbitrary
content.

** Section 11. Would the caution of the mixer not revealing that a user is
hearing or speech impaired noted in Section 8 of RFC5194 apply here too?