Re: [MMUSIC] AD evaluation: draft-ietf-mmusic-latching-04

[Alissa Cooper <[e-mail]>]

Hi Dan,

On 4/1/14 11:42 AM, "Dan Wing" <[e-mail]> wrote:
>
>>> The draft suggests use of SRTP for authenticating media which does
>>> resolve the security issues (from a privacy/confidentiality
>>> perspective). 
>> 
>> I was more concerned with the DoS aspect.
>
>The DoS aspect of authenticating incoming SRTP packets to the SBC?

The DoS aspect that is described in the paragraph Emil quoted below.

>
>
>> 
>>> That's part of section 5:
>>> 
>>>  Naturally, SRTP [RFC3711] would help mitigate such threats and should
>>>  be used independently of HNT.  For example, in cases where end-to-end
>>>  encryption is used it would still be possible for an attacker to
>>>  hijack a session despite the use of SRTP and perform a denial of
>>>  service attack.  However, media integrity would not be compromised.
>>> 


>> I think something like the following might capture the
>> situation better:
>> 
>> OLD:
>> Due to the security issues presented in Section 5, the latching
>>mechanism
>> is considered inappropriate for general use on the Internet unless all
>> security considerations are taken into account and solved.
>> 
>> 
>> NEW:
>> Due to the security issues presented in Section 5, the latching
>>mechanism
>> is considered inappropriate for general use on the Internet, and in
>> controlled environments unless all security considerations are taken
>>into
>> account and solved.
>
>"General use on the Internet" and "in controlled environments" are 100%
>of all networks, so perhaps simplifying to:
>
>NEW:
>  Due to the security issues presented in Section 5, the latching
>mechanism
>  is considered appropriate only when all security considerations are
>taken into
>  account and solved.

I think the text in the -04 is preferable to this, as it is more specific.

I would be interested in others' thoughts on the text I proposed above.

Thanks,
Alissa