Re: [secdir] [payload] sec-dir review of draft-ietf-payload-rtp-opus-08

["Ben Campbell" <[e-mail]>]

On 9 Apr 2015, at 5:11, Colin Perkins wrote:

> On 9 Apr 2015, at 11:04, Stephen Farrell <[e-mail]> 
> wrote:
>> I do agree with Colin here (and with Ben and Robert) but...
>>
>> On 09/04/15 10:58, Colin Perkins wrote:
>>> A document giving normative security guidance for unicast SIP-based
>>> telephony using RTP is something we need, I agree. I'm happy to help
>>> reviewing such a thing, but it should be authored by someone more
>>> familiar with the deployed security mechanisms.
>>
>> I've just gotten offlist mail from another secdir reviewer who
>> noted that we had exactly the same discussion 7 years ago for
>> another payload document. And I recall it myself more recently.
>
> We've been around this loop multiple times. That's why we wrote RFCs 
> 7201 and 7202, to try to stop repeating the same discussion by 
> explaining the issues and providing guidance. The recommended text for 
> new RTP payload formats in the rtp-howto was also intended to help 
> clarify. Clearly something more is needed. If the issue is that 
> RFC7202 isn't clear, then I'm happy to work with someone to clarify in 
> an update, but I suspect we need the suggested documents giving 
> normative requirements for different application classes.

The problem is not that 7202 is not clear. It "clearly" says that the 
each class of RTP application needs to specify MTI strong security. The 
problem is that no such specification exists for SIP-based RTP unicast 
applications. So saying we SHOULD follow 7202 doesn't really help.

>
>> So that unicast SIP/RTP document really would save us all some
>> time and might help those implementing and deploying security
>> stuff in such cases. (And even if folks were not implementing
>> or deploying security stuff for this 7 years ago, I would say
>> that it's much more likely they will be doing that today and
>> in future.)
>
> Agreed.
>
> -- 
> Colin Perkins
> https://csperkins.org/