Re: [bfcpbis] AD evaluation: draft-ietf-bfcpbis-sdp-ws-uri-06

Hi Alissa,

Thanks for your feedback. Please see inline

-----Original Message-----
From: bfcpbis <bfcpbis-bounces@ietf.org> on behalf of Alissa Cooper <alissa@cooperw.in>
Date: Saturday, 10 December 2016 at 1:08 AM
To: "bfcpbis@ietf.org" <bfcpbis@ietf.org>
Subject: [bfcpbis] AD evaluation: draft-ietf-bfcpbis-sdp-ws-uri-06

    I have reviewed this document in preparation for IETF last call. I have a couple of comments to discuss before issuing the last call. I’ve also included some nits below that should be resolved together this IETF LC comments.

    Substantive comments:

    = Section 1 =

    "In most cases it is not viable for certificates signed by well known
       authorities."

<Ram> This text was added to indicate that it is not always possible to get the certificates signed by well known authorities. 

    I don't understand what this sentence means.

    = Section 5 =

    "If there are
       multiple records returned for the connection URI in the "a=wss-uri"
       or "a=ws-uri" then the clients MAY use procedures in Section 4 of
       [RFC6555] to attempt the connection towards the server."

    I'm confused about this. Why would there be multiple URIs? This isn't explained anywhere in the document. (Furthermore, I don't understand the comment from Dan Wing that was the origin of this text, I think. I thought the point of all of this work is to take advantage of the underlying WebSocket to send BFCP messages, so wouldn't DNS resolution be handled by the HTTP stack on the client?)

<Ram> Yes this text was added based on feedback from SDP directorate. I think you have a valid point that the DNS resolution may be taken care at HTTP stack and the procedures in RFC6555 may be used at that level.   In that case this text may not fit well in here.   Do you want me to remove this from the doc  ?

    = Section 6 =

    "Consequently, it is strongly
    RECOMMENDED that integrity protection be applied to the SDP session
    descriptions. For session descriptions carried in SIP [RFC3261], S/
    MIME is the natural choice to provide such end-to-end integrity
    protection."

    Is this just suggesting S/MIME to have nice words in the text, or do you expect to see implementations using S/MIME to protect their SDP bodies?

<Ram> I have not seen many implementations use S/MIME. Most of them use SIP over TLS (even though it may not provide e2e security) in case they need to protect the SIP/SDP

Will take care of the NITS below.

Thanks,
Ram

    Nits:

    = Section 1 =

    OLD
    As defined in Section 3 of [RFC2818], when using Secure WebSockets
       the Canonical Name (CNAME) of the Secure Sockets Layer (SSL)
       [RFC6101] certificate MUST match the WebSocket connection URI host.

    NEW
    When using Secure WebSockets
       the Canonical Name (CNAME) of the Secure Sockets Layer (SSL)
       [RFC6101] certificate MUST match the WebSocket connection URI host (see Section 3 of [RFC2818]).

    = Section 5 =

    s/on Internet/on the Internet/   

    s/ports (80 or 443)/port (80 or 443)/

    = Section 6 =

    s/it is strongly RECOMMENDED/it is RECOMMENDED/

    _______________________________________________
    bfcpbis mailing list
    bfcpbis@ietf.org
    https://www.ietf.org/mailman/listinfo/bfcpbis