Re: [rtcweb] 答复: 答复: Fwd: I-D Action: draft-westerlund-rtcweb-codec-control-00.txt

[Magnus Westerlund <[e-mail]>]

On 2012-05-22 03:25, 邓灵莉/denglingli wrote:
> Hi, Martin
> 
> You are right. According to the current discussion, I would suggest two options about the security threat statement: 
> 1, remove the item c from Section 8; or

I don't think this is an appropriate choice. The reason is that it
applies to multi-party cases where an given end-point targets the other
participants. Mitigation in the media plane central node for this attack
is something the implementation should have.

> 2, add a few words to notify what is left out and may be of concern in the field and people would know what to expect in reality.
> Would you agree?

I would like to make it clear that this documents security consideration
is a short summary of the most important attacks. The COP drafts
security consideration is not existing and that will be addressed in the
next version. That will clearly discuss the SDP angle and at least point
out the need for protection between the nodes. But also that in
multi-party there exist a potential for down-grading the general
constraints.

I will consider adding the SDP based downgrade into this document also.

Cheers

Magnus Westerlund

----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVM
----------------------------------------------------------------------
Ericsson AB                | Phone  [phone]
Färögatan 6                | Mobile [phone]
SE-164 80 Stockholm, Sweden| mailto: [e-mail]
----------------------------------------------------------------------