Re: [AVTCORE] Roman Danyliw's No Objection on draft-ietf-payload-rtp-jpegxs-15: (with COMMENT)

Roman Danyliw <rdd@cert.org> Thu, 10 June 2021 12:35 UTC

Return-Path: <rdd@cert.org>
X-Original-To: avt@ietfa.amsl.com
Delivered-To: avt@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 627B43A1186; Thu, 10 Jun 2021 05:35:50 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cert.org
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eHbbf8cyTtRz; Thu, 10 Jun 2021 05:35:45 -0700 (PDT)
Received: from veto.sei.cmu.edu (veto.sei.cmu.edu [147.72.252.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A5803A117F; Thu, 10 Jun 2021 05:35:44 -0700 (PDT)
Received: from delp.sei.cmu.edu (delp.sei.cmu.edu [10.64.21.31]) by veto.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id 15ACZgRj021493; Thu, 10 Jun 2021 08:35:43 -0400
DKIM-Filter: OpenDKIM Filter v2.11.0 veto.sei.cmu.edu 15ACZgRj021493
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cert.org; s=yc2bmwvrj62m; t=1623328543; bh=Z5QhrD1a0RPPUuowmLIe3ZRnd9r9oGhmDLCNBRKxNPc=; h=From:To:CC:Subject:Date:References:In-Reply-To:From; b=q9v5CtUD72hjc/SWOmEyWQrT7Mv6AadZsmtnFajSboDNvXsG32Shywf8ihH6Ec8c/ 5a9DNK0cajkCltWjYpx0b+buKXFTJoO7vPrDKoyGE49RtdZqvmV5mMcbk9fRS6qV9t OZJm5qGg7ebtx9mSGK+UE37qfQxK/wOJTfvVDr80=
Received: from MORRIS.ad.sei.cmu.edu (morris.ad.sei.cmu.edu [147.72.252.46]) by delp.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id 15ACZdTI048014; Thu, 10 Jun 2021 08:35:39 -0400
Received: from MORRIS.ad.sei.cmu.edu (147.72.252.46) by MORRIS.ad.sei.cmu.edu (147.72.252.46) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2242.4; Thu, 10 Jun 2021 08:35:39 -0400
Received: from MORRIS.ad.sei.cmu.edu ([fe80::555b:9498:552e:d1bb]) by MORRIS.ad.sei.cmu.edu ([fe80::555b:9498:552e:d1bb%13]) with mapi id 15.01.2242.008; Thu, 10 Jun 2021 08:35:39 -0400
From: Roman Danyliw <rdd@cert.org>
To: Tim Bruylants <TBR@intopix.com>, The IESG <iesg@ietf.org>
CC: "draft-ietf-payload-rtp-jpegxs@ietf.org" <draft-ietf-payload-rtp-jpegxs@ietf.org>, "avtcore-chairs@ietf.org" <avtcore-chairs@ietf.org>, Ali Begen <ali.begen@networked.media>, "avt@ietf.org" <avt@ietf.org>, "bernard.aboba@gmail.com" <bernard.aboba@gmail.com>
Thread-Topic: Roman Danyliw's No Objection on draft-ietf-payload-rtp-jpegxs-15: (with COMMENT)
Thread-Index: AQHXXWaHGESRwwbYVUSw+r1QHsaKVKsNEZcAgAAdWzA=
Date: Thu, 10 Jun 2021 12:35:37 +0000
Message-ID: <37a3c0acbecd45228c194d49f4ba66ca@cert.org>
References: <162326727198.29714.11233454715669304814@ietfa.amsl.com> <PR3P192MB0748FDFA32628F85514F2EA2AC359@PR3P192MB0748.EURP192.PROD.OUTLOOK.COM>
In-Reply-To: <PR3P192MB0748FDFA32628F85514F2EA2AC359@PR3P192MB0748.EURP192.PROD.OUTLOOK.COM>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.64.202.170]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/avt/MwXJNtjKbDnAMQ0UaDiwJTtlLCE>
Subject: Re: [AVTCORE] Roman Danyliw's No Objection on draft-ietf-payload-rtp-jpegxs-15: (with COMMENT)
X-BeenThere: avt@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Audio/Video Transport Core Maintenance <avt.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/avt>, <mailto:avt-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/avt/>
List-Post: <mailto:avt@ietf.org>
List-Help: <mailto:avt-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/avt>, <mailto:avt-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Jun 2021 12:35:51 -0000

Hi Tim!

Top posting only to say thanks for the quick turn-around and the updated -16 draft.  I've cleared my ballot.

Regards,
Roman

> -----Original Message-----
> From: iesg <iesg-bounces@ietf.org> On Behalf Of Tim Bruylants
> Sent: Thursday, June 10, 2021 2:49 AM
> To: Roman Danyliw <rdd@cert.org>rg>; The IESG <iesg@ietf.org>
> Cc: draft-ietf-payload-rtp-jpegxs@ietf.org; avtcore-chairs@ietf.org; Ali Begen
> <ali.begen@networked.media>ia>; avt@ietf.org; bernard.aboba@gmail.com
> Subject: RE: Roman Danyliw's No Objection on draft-ietf-payload-rtp-jpegxs-15:
> (with COMMENT)
> 
> Thank you for the review and feedback.
> 
> I have prepared a new draft document that addresses your comments.
> 
> > ----------------------------------------------------------------------
> > COMMENT:
> > ----------------------------------------------------------------------
> 
> > ** Section 4.1. Typo. s/preceeded/preceded/
> 
> Fixed.
> 
> > ** Section 10.  . Thanks for mentioning the possibility of a denial of service
> > due computational complexity.   Please considering adding a comment about
> > processing untrusted input (similar to the language in other RTP payload
> drafts
> > like: draft-ietf-payload-vp9 and draft-ietf-cellar-ffv1).  Roughly:
> >
> > OLD
> >    This payload format and the JPEG XS encoding do not exhibit any
> >    substantial non-uniformity, ...
> >
> > NEW
> >
> > Implementations of this RTP payload format need to take appropriate
> security considerations into account.  It is important for the decoder to be
> robust
> > against malicious or malformed payloads and     ensure that they do not
> cause
> > the decoder to overrun its allocated memory or otherwise misbehave.  An
> overrun in allocated memory could lead to arbitrary code execution by an
> attacker.  The same applies to the > encoder, even though problems in
> encoders are typically rarer.
> >
> > This payload format and the JPEG XS encoding do not exhibit any substantial
> non-uniformity, ...
> 
> Indeed, this is very useful to explain. Somehow it seems so obvious that we did
> not think about writing it down. Thanks for the suggestion.