Re: [MMUSIC] Review (by dhanes) of draft-holmberg-mmusic-udptl-dtls-02

[Christer Holmberg <[e-mail]>]

Hi David,

Thanks for your comments! Due to xmas/new year vacations, it may take a while before I get a chance to reply. Just to let you know :)

Regards,

Christer

Lähettäjä: David Hanes (dhanes) [mailto:[e-mail]]
Lähetetty: 19. joulukuuta 2013 21:18
Vastaanottaja: Christer Holmberg; [e-mail]
Aihe: Review (by dhanes) of draft-holmberg-mmusic-udptl-dtls-02


Overall this is a well written document. It is clear and concise and the technical aspect is solid. My comments are below:



-David











1) For some reason, I can't seem to get past the wording on this first sentence in Section 1. I feel like it could be stated a bit clearer. The point I think is that there are means to send faxes across the PSTN in a secure manner but it was never a priority due to the barrier of physical access. This is probably just personal preference but I feel a wording similar to the following gets the point across better:



"While it is possible to transmit highly sensitive documents using traditional telephony encryption devices, secure fax on the Public Switched

Telephone Network (PSTN) was never widely considered or prioritized. This was mainly because of the challenges involved with physical access to telephony equipment."









2) In the last sentence of the first paragraph of Section 1, the following statement is made "Some of the security mechanisms for securing fax include:" and then a T.30 and T.38 scheme is mentioned. I think that this has been brought up before but SRTP using fax passthrough is more widely deployed in my experience than either of the other secure faxing methods. I realize that this document is written under the context of UDPTL-based fax but here in the introduction the topic so far is secure fax in a general sense and it has yet to be narrowed down to just UDPTL-based fax. It seems like a glaring omission that SRTP fax solutions are not mentioned here. I think SRTP needs to be added if this is kept in its present form and wording. Or this section could be changed in a manner similar to the following.  This will address the omission of SRTP from my perspective:





   While telephony encryption devices have been traditionally used for

   highly sensitive documents, secure fax on the Public Switched

   Telephone Network (PSTN) was not as widely considered or prioritized

   because of the challenges involved with physical access to telephony

   equipment.  As real-time communications transition to IP networks,

   where information might potentially be intercepted or spoofed, an

   appropriate level of security for fax that offers integrity and

   confidentiality protection is vital.



   The overwhelmingly predominant fax transport protocol today is

   UDPTL-based. The protocol stack for fax transport using UDPTL is shown

   in Table 1.



                      +-----------------------------+

                      |           Protocol          |

                      +-----------------------------+

                      | Internet facsimile protocol |

                      +-----------------------------+

                      |            UDPTL            |

                      +-----------------------------+

                      |             UDP             |

                      +-----------------------------+

                      |              IP             |

                      +-----------------------------+



                Table 1: Protocol stack for UDPTL over UDP



   Implementations exist today for securing this fax transport type. Some of these

   mechanisms are:



   o  [ITU.T30.2005] Annex H specifies integrity and confidentiality

      protection of fax in application layer, independent of protocol

      for fax transport.

   o  [ITU.T38.2010] specifies fax transport over RTP/SAVP which enables

      integrity and confidentiality protection of fax in IP network.



   Despite these mechanisms to secure fax, there is no transport layer

   security offering integrity and confidentiality protection for UDPTL. This issue

   was addressed in a study by the 3rd Generation Partnership Project (3GPP)

   on how to provide secure fax in the IP Multimedia Subsystem (IMS). They

   concluded that secure fax shall be transported using UDPTL over DTLS.





My rewrite here simply places the current secure fax options for UDPTL after the introduction of UDPTL itself. I think this builds better from a general discussion on secure fax, to an introduction of UDPTL, to an explanation of current UDPTL secure fax offerings, to the 3GPP study recommendation.









3) Shouldn't the title for Table 2 be "Protocol stack for UDPTL over DTLS" and not "Protocol stack for UDPTL over UDP"?