[rtcweb] Kathleen Moriarty's No Objection on draft-ietf-rtcweb-rtp-usage-24: (with COMMENT)

["Kathleen Moriarty" <[e-mail]>]

Kathleen Moriarty has entered the following ballot position for
draft-ietf-rtcweb-rtp-usage-24: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-rtcweb-rtp-usage/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you for your work on this well-written draft.  The SecDir review
picked up on a number of nits that should be corrected, tow in the
Security considerations section in particular.
The full review can be found here:
http://www.ietf.org/mail-archive/web/secdir/current/msg05759.html

And the specific fixes for the security considerations text is as
follows:
The security considerations section was comprehensive and security
impacts were taken into account throughout this draft.  I have two small
NIT’s about the security section that I would like improved, and I feel
these are rather small:  First, in the paragraph in the security section
that starts “RTCP packets convey a Canonical Name…”  the authors state
that the CNAME generation algorithm in described in section 4.9 – it
isn’t, section 4.9 references RFC7022 for the generation algorithm. 
Second, the last paragraph on page 39, starting with “Providing source
authentication in multi-party…” ends the page with a large security
warning.   Please include a reference in that paragraph in the security
considerations and possibly to the appropriate draft/RFC which discusses
that issue in some more depth.