[MMUSIC] ICEbis: INTEGRITY attribute in Binding Responses clarification

["Pal Martinsen (palmarti)" <[e-mail]>]

Hi,

I was reading through the ICE RFC and trying to figure out if Binding Responses needed the INTEGRITY attribute. Usually the ICE RFC is very descriptive in what to include in the messages, but I could not find any text clearly stating that the INTEGRITY attribute must be included in the Binding Responses. 

When reading the STUN RFC it states in section 7.3.1.1:
"If the server authenticated the request using an authentication
 mechanism, then the server SHOULD add the appropriate authentication
 attributes to the response (see Section 10)."

Is this SHOULD strong enough for the connectivity checks performed by ICE? 
Should it be changed to a MUST?

To spell it out for readers like me, I propose the following changes to section 7.2 the second paragraph of the ICE RFC
(http://tools.ietf.org/html/draft-keranen-mmusic-rfc5245bis-01#section-7.2)

 The agent MUST use a short-term credential (i.e., the
 MESSAGE-INTEGRITY attribute) to authenticate and
 perform a message integrity check on the request and 
 any response to that request. 

Adding the following to section 7.1.3.1 might also help to remind the implementors:

  The agent MUST use the INTEGRITY-MESSAGE attribute in the Binding Response to authenticate the message. 


.-.
Pål-Erik Martinsen