Re: [MMUSIC] Review (by dhanes) of draft-holmberg-mmusic-udptl-dtls-02

[Christer Holmberg <[e-mail]>]

Hi David,

Again, thanks for your comments! Reply inline.

> 1) For some reason, I can't seem to get past the wording on this first sentence in Section 1. I feel like it could be stated a bit clearer. The point 
> I think is that there are means to send faxes across the PSTN in a secure manner but it was never a priority due to the barrier of physical 
> access. This is probably just personal preference but I feel a wording similar to the following gets the point across better:
>
>
> "While it is possible to transmit highly sensitive documents using traditional telephony encryption devices, secure fax on the Public Switched
> Telephone Network (PSTN) was never widely considered or prioritized. This was mainly because of the challenges involved with physical access to telephony equipment."

I am ok with your suggested change.


-----------------------


> 2) In the last sentence of the first paragraph of Section 1, the following statement is made "Some of the security mechanisms for securing fax include:" and then a T.30 and T.38 
> scheme is mentioned. I think that this has been brought up before but SRTP using fax passthrough is more widely deployed in my experience than either of the other secure 
> faxing methods. I realize that this document is written under the context of UDPTL-based fax but here in the introduction the topic so far is secure fax in a general sense and it 
> has yet to be narrowed down to just UDPTL-based fax. It seems like a glaring omission that SRTP fax solutions are not mentioned here. I think SRTP needs to be added if this is 
> kept in its present form and wording. Or this section could be changed in a manner similar to the following.  This will address the omission of SRTP from my perspective:


I am ok with your suggested rewrite.

Note, though, that  [ITU.T38.2010] does define the usage of T.38 over RTP.


>   While telephony encryption devices have been traditionally used for
>   highly sensitive documents, secure fax on the Public Switched
>   Telephone Network (PSTN) was not as widely considered or prioritized
>   because of the challenges involved with physical access to telephony
>   equipment.  As real-time communications transition to IP networks,
>   where information might potentially be intercepted or spoofed, an
>   appropriate level of security for fax that offers integrity and
>   confidentiality protection is vital.
>
>   The overwhelmingly predominant fax transport protocol today is
>   UDPTL-based. The protocol stack for fax transport using UDPTL is shown
>   in Table 1.
>
>
>                      +-----------------------------+
>
>                      |           Protocol          |
>
>                      +-----------------------------+
>
>                      | Internet facsimile protocol |
>
>                      +-----------------------------+
>
>                      |            UDPTL            |
>
>                      +-----------------------------+
>
>                      |             UDP             |
>
>                      +-----------------------------+
>
>                      |              IP             |
>
>                      +-----------------------------+
>
>
>                Table 1: Protocol stack for UDPTL over UDP
>
>
>   Implementations exist today for securing this fax transport type. Some of these
>   mechanisms are:
>
>
>   o  [ITU.T30.2005] Annex H specifies integrity and confidentiality
>      protection of fax in application layer, independent of protocol
>      for fax transport.
>
>   o  [ITU.T38.2010] specifies fax transport over RTP/SAVP which enables
>      integrity and confidentiality protection of fax in IP network.
>
>
>   Despite these mechanisms to secure fax, there is no transport layer
>   security offering integrity and confidentiality protection for UDPTL. This issue
>   was addressed in a study by the 3rd Generation Partnership Project (3GPP)
>   on how to provide secure fax in the IP Multimedia Subsystem (IMS). They
>   concluded that secure fax shall be transported using UDPTL over DTLS.


------------------


>3) Shouldn't the title for Table 2 be "Protocol stack for UDPTL over DTLS" and not "Protocol stack for UDPTL over UDP"?

I guess it should be "Protocol stack for UDPTL over DTLS over UDP"


Regards,

Christer