Re: [secdir] sec-dir review of draft-ietf-payload-rtp-opus-08

[Roni Even <[e-mail]>]

Hi,
The reason for the may is discussed in RFC7201 and RFC 7202, it can be a SHOULD and these  RFCs exaplain when it is not required to use SRTP.
Maybe add a reference to these RFCs in the security section when saying talking about good reasons for not using SRTP

Roni Even

________________________________________
From: Jean-Marc Valin [[e-mail]] on behalf of Jean-Marc Valin [[e-mail]]
Sent: Tuesday, February 17, 2015 10:23 PM
To: Derek Atkins; [e-mail]; [e-mail]
Cc: [e-mail]; [e-mail]; [e-mail]
Subject: Re: sec-dir review of draft-ietf-payload-rtp-opus-08

Hi Derek,

There was no particular reason for the MAY, the text was merely copied
from other RTP payload RFC. I totally agree with making it a SHOULD.

Thanks,

        Jean-Marc

On 17/02/15 02:54 PM, Derek Atkins wrote:
> Hi,
>
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written with the intent of improving
> security requirements and considerations in IETF drafts.  Comments
> not addressed in last call may be included in AD reviews during the
> IESG review.  Document editors and WG chairs should treat these
> comments just like any other last call comments.
>
> Summary:
>
> Ready to publish with a question: I question why the use of SRTP is a
> MAY and not a SHOULD (as detailed in the Security Considerations
> section).  Considering PERPASS I believe this should be a SHOULD;
> someone should have a very good reason why they are NOT using SRTP.
>
> Details:
>
>    This document defines the Real-time Transport Protocol (RTP) payload
>    format for packetization of Opus encoded speech and audio data
>    necessary to integrate the codec in the most compatible way.
>    Further, it describes media type registrations for the RTP payload
>    format.
>
> I have no other comments on this document.
>
> -derek
>