Re: [bfcpbis] WGLC for draft-ietf-bfcpbis-rfc4583bis

[Roman Shpount <[e-mail]>]

On Mon, Sep 25, 2017 at 4:30 PM, Charles Eckel (eckelcu) <[e-mail]>
wrote:

> This section specifies that "This implies that unless a 'fingerprint'
> attribute is included in the session description, the certificate provided
> at the TLS-/DTLS-level MUST either be directly signed by one of the other
> party's trust anchors or be validated using a certification path that
> terminates at one of the other party's trust anchors [5]". I thought
> "fingerprint" attribute are required and certificate signature by trust
> anchor is irrelevant.
>
>
>
> Not sure what "When using UDP, the procedure above was preferred since it
> adheres to [16] as used for DTLS-SRTP" means, especially since [16} is not
> specific to SRTP-DTLS, but specifies generic rules for all DTLS based
> protocols. The whole logic is circular since it proposes to follow
> procedures from [16] since they are compliant with procedures from [16].
>
>
>
> TK: I'm currently trying to remember the background for this text, it was
> altered and added in one of the many rounds earlier on. I agree that this
> is not clear and a bit confusing.
>
> [cue] After consulting the archives, it seems this was introduced in
> version -04 of the draft as a result of an issue raised by Gonzalo.
>
> https://mailarchive.ietf.org/arch/msg/bfcpbis/
> emDvYolUyI4VjEiVuBqNoWMgz40/?qid=0e356a8b7a948f87669c6d992f6214db
>
>
>

The current text read like this "When DTLS is used with UDP, the
requirements specified in Section 5 of [16] MUST be followed". In
the following paragraph this is explained saying "When using UDP, the
procedure above was preferred since it adheres to [16] as used for
DTLS-SRTP, it does not overload offer/answer semantics, and it works for
offerless INVITE in scenarios with B2BUAs". I am not sure why this
explanation is needed, since it essentially says that procedure from
DTLS-SDP draft is used since it is compatible with procedure from DTLS-SDP
draft.

I think the second sentence can be rewritten to say: "When using UDP,
procedure defined in [16] was selected in order to be compatible with other
DTLS based protocol implementations, such as DTLS-SRTP. Furthermore,
procedure defined in [16] does not overload offer/answer semantics and
works for offerless SIP INVITE in scenarios with B2BUAs.

Regards.
_____________
Roman Shpount