Re: [Perc] Magnus Westerlund's Discuss on draft-ietf-perc-double-10: (with DISCUSS and COMMENT)

[Cullen Jennings <[e-mail]>]

> 
> 1. Section 5.1:
> 
> To me it appears that one fundamental security flaw exists in the definition of
> the inner encryption. That is the fact that RTP padding is not included into
> the inner encrypted part. This prevents the application of RTP padding to
> prevent the potential privacy leakage that "Guidelines for the Use of Variable
> Bit Rate Audio with Secure RTP" (RFC 6562) documents. To prevent this type of
> information leakage and other privacy preserving operations based on applying
> RTP padding it would be necessary to include the RTP padding into the inner
> encrypted envelope. Appendix A figure indicates that is the case, but the
> process description in 5.1 is not matching that.
> 

So my read of 5.1 is that does this. Clearly we need to make the text clear that it does that - what part of the 5.1 makes you think the padding is stripped from the  payload ?

Perhaps to make it explicitly clear we should change 

"* Payload: The RTP payload of the original packet”

to be 

"* Payload (including padding) The RTP payload (including passing) of the original packet”