Re: [avtext] Kathleen Moriarty's No Objection on draft-ietf-avtext-splicing-notification-07: (with COMMENT)

[[e-mail]]

Sent from my iPhone

> On Jun 20, 2016, at 5:29 AM, Mirja Kuehlewind (IETF) <[e-mail]> wrote:
> 
> Hi Colin,
> 
> see below.
> 
>>> Am 16.06.2016 um 00:34 schrieb Colin Perkins <[e-mail]>:
>>> 
>>> On 15 Jun 2016, at 19:37, Kathleen Moriarty <[e-mail]> wrote:
>>> 
>>> Kathleen Moriarty has entered the following ballot position for
>>> draft-ietf-avtext-splicing-notification-07: No Objection
>>> 
>>> When responding, please keep the subject line intact and reply to all
>>> email addresses included in the To and CC lines. (Feel free to cut this
>>> introductory paragraph, however.)
>>> 
>>> 
>>> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
>>> for more information about IESG DISCUSS and COMMENT positions.
>>> 
>>> 
>>> The document, along with other ballot positions, can be found here:
>>> https://datatracker.ietf.org/doc/draft-ietf-avtext-splicing-notification/
>>> 
>>> 
>>> 
>>> ----------------------------------------------------------------------
>>> COMMENT:
>>> ----------------------------------------------------------------------
>>> 
>>> I strongly support Mirja's and Alia's discuss points and would like to
>>> see more of a discussion of the capability to hide splicing in the
>>> security considerations text.  My ballot would be discuss, but they
>>> pulled out the relevant sections and that would be duplication.  I'd like
>>> to review agreed upon text though to address these concerns.  
>>> 
>>> I don't like the idea of enabling a MiTM, but do see the draft talks
>>> about how to protect headers when this happens and confidentiality is
>>> needed as well as session protection between the endpoints and the
>>> splicer (which I don't like either, but you do call out the security
>>> considerations of this and that's what is needed).
>> 
>> The mechanism described doesn’t work unless the receiver explicitly chooses to receive media content delivered via the splicer. I agree that the draft could be more clearly written, but it doesn’t seem to be “enabling a MiTM” attack, since the receiver opts in.
> 
> This definitely need from clarification in the draft!

Yes, can we see some proposed text?  

Thank you,
Kathleen 
> 
> Mirja
> 
> 
>> 
>> -- 
>> Colin Perkins
>> https://csperkins.org/
>