Re: [Insipid] I-D Action: draft-ietf-insipid-session-id-23.txt

["Ben Campbell" <[e-mail]>]

On 28 Jun 2016, at 15:06, Paul Giralt (pgiralt) wrote:


[...]

>> As it is, 4.2 says they generate a new, previously unused UUID. Is 
>> there any normative text about reusing the UUID for more than one 
>> "session"? (Not counting the text about transfers, etc.).
>
>
>
> The only the only text  is Section 6 which describes the conditions 
> under which the UUID is maintained. The transfer / redirect cases are 
> the only time a UUID is “reused” and even then, it’s not really 
> being reused for a different “session” but that depends on what 
> you fine as being a session. That may be the issue - that we don’t 
> clearly define what a session is.

That text talks about when the UUID MUST NOT change. I'm looking for 
text that says a UUID value MUST NOT be reused across multiple 
"sessions" (as sessions are defined in this draft.) The point is to 
avoid an accidentally persistent identifier that could be used to track 
user/UA activity across multiple sessions.

>
> I added an additional line at the end of paragraph 1 in section 4.2 to 
> highlight the persistence of the UUID mentioned in Section 6:
>
> 	Section 6 describes how the UUIDs selected by the source and 
> destination UAs persist
>         for the duration of the session.
>
> Not sure if that’s necessary, but I figured it can’t hurt.
>
> Would it help if we give a clearer definition of what a “session” 
> means in the context of this specification?

While additional clarity rarely hurts, I did not find the concept of 
session in the draft to be particularly confusing, even if it did go 
beyond conventional ideas of what constitutes a session in SIP.