Re: [AVTCORE] I-D Action: draft-ietf-avt-srtp-not-mandatory-11.txt

[Harald Alvestrand <[e-mail]>]

On 11/19/2012 11:59 PM, Colin Perkins wrote:
> This version of the draft updates the recommendations in Section 6 based on discussion with the Security Area Directors. There are no changes in the rest of the draft.

Mostly looks OK to me.

One thing I did not understand about the new section 6 ....
It describes RTP/AVPF as a profile that is an example of where a single 
security mechanism is not reasonable to mandate, because it's used in 
many other contexts.
I think that's OK - but isn't it true that RTP/AVPF *disallows* the use 
of SRTP, since it would then be RTP/SAVPF?

This can be confusing to the reader - it may be clearer if one mentions 
explicitly that the RTP/AVPF, which is a set of building blocks that 
don't need a security mandate, is used to build RTP/SAVPF, which *is* a 
security mandate.

Or am I the one confused?

                 Harald

>
> Colin
>
>
> On 19 Nov 2012, at 22:51, [e-mail] wrote:
>> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>> This draft is a work item of the Audio/Video Transport Core Maintenance Working Group of the IETF.
>>
>> 	Title           : Securing the RTP Protocol Framework: Why RTP Does Not Mandate a Single Media Security Solution
>> 	Author(s)       : Colin Perkins
>>                           Magnus Westerlund
>> 	Filename        : draft-ietf-avt-srtp-not-mandatory-11.txt
>> 	Pages           : 10
>> 	Date            : 2012-11-19
>>
>> Abstract:
>>    This memo discusses the problem of securing real-time multimedia
>>    sessions, and explains why the Real-time Transport Protocol (RTP),
>>    and the associated RTP control protocol (RTCP), do not mandate a
>>    single media security mechanism.  Guidelines for designers and
>>    reviewers of future RTP extensions are provided, to ensure that
>>    appropriate security mechanisms are mandated, and that any such
>>    mechanisms are specified in a manner that conforms with the RTP
>>    architecture.
>>
>>
>> The IETF datatracker status page for this draft is:
>> https://datatracker.ietf.org/doc/draft-ietf-avt-srtp-not-mandatory
>>
>> There's also a htmlized version available at:
>> http://tools.ietf.org/html/draft-ietf-avt-srtp-not-mandatory-11
>>
>> A diff from the previous version is available at:
>> http://www.ietf.org/rfcdiff?url2=draft-ietf-avt-srtp-not-mandatory-11
>