Re: [MMUSIC] WGLC on draft-ietf-mmusic-sdp-uks-03

["Martin Thomson" <[e-mail]>]

Thanks for the review Flemming,

I've made changes as suggested below, which you can review here: https://github.com/martinthomson/sdp-uks/pull/8

All the changes I have made are on https://github.com/martinthomson/sdp-uks/pull/9 if you want to see the entire batch of changes.

On Tue, Feb 26, 2019, at 15:45, Flemming Andreasen wrote:
> Hi Martin 
> 
>  I also took a closer look at the document and have a few additional 
> comments (as individual):
> 
>  Non-Editorial
>  =========
>  Section 2.3, second paragraph: The description on how 3PCC can work 
> with the proposed mechanism is a bit vague. It would be helpful to 
> expand it and provide an example.

Can do.

"For 3PCC to work with the proposed mechanisms, TLS peers need to be aware of the
signaling so that they can correctly generate (and check) the extension.  Peers
need access to any identity assertions present in signaling in order to perform
the checks in {{external_id_hash}}.  To perform the checks in
{{external_session_id}}, a 3PCC system needs to ensure that guarantee that peers
use the same SDP `tls-id` attribute value."

>  Section 3, last paragraph: The text seems out of place here. The text 
> implicitly refers to the previous paragraph, which doesn't seem to make 
> sense. 

Bo made the same comment.  I moved it up and expanded it a little.

>  Section 3.1, second paragraph: "In the first session, Patsy is 
> presented with the option to communicate with Norma"
>  How is that possible when the signaling originates from Mallory (I 
> thought we had signaling integrity and authenticated identity) ? 

The previous paragraph says "it is assumed that the attacker also controls the signaling channel."  As I mentioned in my other mail, when there is an identity binding, we assume that the signaling service is an attacker.  I've made some edits to the corresponding introductory text in response to Bo's review.  Let me know if you think that clears things up, or could be improved.