[AVTCORE] Comments on draft-ietf-avt-srtp-not-mandatory-09

["Brandenburg, R. (Ray) van" <[e-mail]>]

Hi Colin/Magnus,


This is my review of draft-ietf-avt-srtp-not-mandatory-09. Since I'm not a security expert, I can't say anything about the security implications of the document. That said, I do have some other comments. I've not been following the discussion on this topic very closely on the list, so please excuse me if any topics I bring up have already been discussed on list earlier.


1) The page-header of the draft is 'SRTP is not the only RTP Security Option'. Although I understand that this header summarizes the rationale for writing the draft in the first place, from reading the abstract and introduction of the draft, this header seems a little out of place. I would suggest to either more clearly describe its relevance in the abstract or introduction (where SRTP is not mentioned), or choose a different header.


2) Section 3, paragraph 3 states that SRTP is not suitable for some scenarios and applications. I completely agree with this, but the text could use at least one example of such an application or scenario, and reasons for SRTP not being applicable to that application, especially since it is fundamental to the argument being made in the draft (that there is no individual RTP security methods which is suitable for all applications). Basically, the draft spends a lot of time explaining why RTP is a framework and it is therefore not possible to mandate any single security mechanism, however, it doesn't explain why the most-used security mechanism (SRTP) is not suitable for this.


3) Section 6 describes the actual guidelines for future security extensions for RTP that are mentioned in the abstract, and in that sense forms a important part of the draft. It might be useful to more clearly indicate/highlight them in that way (e.g. by changing the section title to include the word 'guidelines').


4) The conclusion (section 7) states 'it is hoped that this memo explains why SRTP is not mandatory as the media security solution for RTP-based systems'. This conclusion could be supported by more substantial arguments in the rest of the document, especially related to SRTP, which is not mentioned apart from the brief mention in section 3, where no actual arguments are given. See also comment 2).


5) And some nits:

- Section 7: comon -> common

- Section 7: important consider -> important to consider

- Section 7: applications -> application


Best regards,


Ray
This e-mail and its contents are subject to the DISCLAIMER at http://www.tno.nl/emaildisclaimer