[bfcpbis] AD evaluation: draft-ietf-bfcpbis-bfcp-websocket-11

[Alissa Cooper <[e-mail]>]

I have reviewed this document in preparation for IETF last call. It is in good shape but I have a couple of comments to discuss before issuing the last call. I’ve also included some nits below that should be resolved together this IETF LC comments.


Substantive comments:

= Section 5 =

"The BFCP server is a server, on the Internet, and thus doesn't need
   ICE and thus the clients always initiate connection to it, and the
   clients only validate its certificate and the clients do not include
   their certificate in TLS ClientHello."

This is text from the SDP directorate review of draft-ietf-bfcpbis-sdp-ws-uri right? I'm not really clear on why all of it needs to be in this document, or in this section which is about transport reliability, at least. I would suggest:

"The BFCP server is a server on the Internet and thus does not require ICE as clients always initiate connections to it."

= Section 6.2 =

s/as the a=ws-uri or a=wss-uri SHALL provide port number when needed./as the a=ws-uri or a=wss-uri SHOULD provide port number when needed./

If it's not always needed then SHOULD is more appropriate than SHALL.

= Section 8 =

OLD
The BFCP client validates the server by means of verifying server certificate and this requires wss-uri contains a hostname. a=fingerprint is not used here in the verification process.

NEW
The BFCP client validates the server by means of verifying the server certificate. This means the wss-uri MUST contain a hostname. The verification process does not use a=fingerprint.

= Section 9 =

Don't the security considerations from RFC 6455 apply as well?

= Section 12.1 =

I think RFC 7525 and draft-ietf-bfcpbis-rfc4583bis should be normative references.


Nits:

= General =

Per the RFC style guide, when a document has more than 5 authors, 1 or 2 editors should be chosen and the remaining authors listed in the Contributors section.

= Section 4.1 =

s/the value "bfcp"/the value "BFCP"/

= Section 6.1 =

s/When TCP is used as the transport, the port field is set following/The port field is set following

OLD
So, while the recommendation to use Secure WebSockets (i.e.
   TCP/WSS) is for security reasons, it is also to achieve maximum
   compatibility among clients.

NEW
So, while this document recommends the use of Secure WebSockets (i.e.
   TCP/WSS) for security reasons, TCP/WS is also permitted so as to achieve maximum
   compatibility among clients.

= Section 6.2 and 7.1 =

These sections have formatting problems and repeated text that need to be fixed.

= Section 8 =

s/with webSocket server/with the WebSocket server/