Re: [MMUSIC] WGLC on draft-ietf-mmusic-sdp-uks-03

Hi Martin,

I've now also reviewed this and have a set of comments and questions, after taking Magnus' comments and your suggested edits in response to that into account:

Section 2.1:
* In bullet 2, "complete communications" is slightly unclear (more so if "complete" is used in other contexts further down in the text). Do you with "complete" mean "accept", or perhaps "accept setting up"?

* Don't understand what is meant with "...second condition..."; is it bullet #2, or is it referring to "...joining two separate sessions"?

* Also don't really understand in what way that second condition is "not necessary"; to limit the attacker capabilities (related to bullet #2), for the attacker to join two sessions, or something else like "for the attack to succeed"?

* Just to confirm, does "removing this constraint" refer to removing use of an identity binding?

Section 3:
* Is the "victim" of the first paragraph the same or another victim compared to the one mentioned in the next paragraph?

* Is "another entity of the attacker's choice" also to be considered a victim?

* The last paragraph in section 3, just before section 3.1 "The same technique..." seems a bit misplaced, after text talking about a solution. Should it perhaps be moved just before the paragraph "The problem..." in section 3? Or, is this "same technique" referring to what is described in section 4?

Section 4:
* First sentence, "similar attack"; similar to what?

Section 4.1:
* Believe it would be helpful for the reader to better understand why "Mallory has no real interest in seeing that session complete"

* Same sentence, does "session complete" mean "session setup complete"? I first interpreted "complete" as "conclude" in the meaning "terminate".

* Same paragraph, should "call completion" be "call setup completion", and "session completes" be "session setup completes"?

* Same paragraph, "will likely be discarded by Patsy"; believe it would be helpful to say why.

Section 4.2:
* I believe the first paragraph ("An attack on... ...vulnerable to attack.") would also be helpful as first text of section 4. Move? Copy?

* "Validating that peers..." -> "Successful validation that peers..."?

Section 4.3:
* "When used with SDP, the value includes..." -> "When used with SDP, the value MUST consist of..."?

Section 5:
* "Use of the "external_session_id"
   does not guarantee that the identity of the peer at the TLS layer is
   the same as the identity of the signaling peer"; sounds a bit strange - isn't this what the draft is supposed to solve? Is "... when used with session concatenation" meant? 

* "Similarly, data from one TLS connection..."; I assume "data" means "security-related information", not "user data" (TLS payload)?

Nits:

Section 2.2:
* geniune -> genuine

Section 4:
* "believe that is calling" -> "believe that it is calling"

Section 4.1:
* "also needs to the ability" -> "also needs the ability"
* "ostensibly between Mallory and Norma, is complete.  Mallory begins forwarding DTLS" -> "ostensibly between Mallory and Norma, Mallory begins forwarding DTLS"
* "These packets denoted" -> "These packets are denoted"

Section 5:
* concatention -> concatenation

Cheers,
Bo (as individual)

-----Original Message-----
From: mmusic <mmusic-bounces@ietf.org> On Behalf Of Martin Thomson
Sent: den 22 januari 2019 00:00
To: Magnus Westerlund <magnus.westerlund@ericsson.com>; Flemming Andreasen <fandreas@cisco.com>; mmusic <mmusic@ietf.org>
Cc: draft-ietf-mmusic-sdp-uks@ietf.org
Subject: Re: [MMUSIC] WGLC on draft-ietf-mmusic-sdp-uks-03

On Thu, Jan 17, 2019, at 19:50, Magnus Westerlund wrote:
> Hi Martin,
> 
> Thanks for the pull request. I have detailed inline comments, but I 
> think the pull request do address my issues.

Thanks again Magnus.

I made a few tweaks regarding canonicalization (or lack thereof) and merged the PR.  I'll await the end of the WGLC and the chairs' instruction before publishing again, but there's a preview here:

https://martinthomson.github.io/sdp-uks/draft-ietf-mmusic-sdp-uks.html

> Although I didn't read all the sections in 7, I do agree that security 
> arch appear to need some clarification so that what you write is clear.

FWIW, https://github.com/rtcweb-wg/security-arch/pull/84 attempts to fix that.

_______________________________________________
mmusic mailing list
mmusic@ietf.org
https://www.ietf.org/mailman/listinfo/mmusic