[MMUSIC] Updates to BUNDLE "Security Considerations"

[Suhas Nandakumar <[e-mail]>]

Hello Bundle Authors

   As part of discussions on the Stephen Farrell's "COMMENT" on the SDP Mux
Draft during IESG Evaluation, there was a  proposal made to update the
Security Considerations section of the BUNDLE draft to address security
concern raised by Stephen.

The issue:
   When using a=crypto (TRANSPORT category) attribute across media
sections, the Offer/Answer negotiation MAY end up in selecting a media
section with a weaker a=crypto line.

The Proposal (from Cullen):

 So here my straw man suggestion ... it seems like the right place to
> mention this is in the security consideration for bundle and point
> out that if you offer multiple m-lines that are bundled, the
> recommendation is for the offers and answers to have the same security
> level or put the m-line with the highest level security first so that
> if bundle is selected, we get the strongest security.



Full discussion can be found here:
 https://www.ietf.org/mail-archive/web/mmusic/current/msg17184.html




Thanks
Suhas