Re: [secdir] Secdir review of draft-ietf-mmusic-rfc2326bis-34

["Chris Lonvick (clonvick)" <[e-mail]>]

Hi All,

I looked over those sections on my long-ish flight and have written up some notes while I'm waiting for my very much delayed final leg back home.

Without a thorough reading of the entire document, I'll say that I understand the intentions of Appendix C.1.4, and Section 19, but havn't fully wrapped my head around it.  I'll also say that I'm not well versed in MIKEY.  Since it stood out, I also looked at Appendix G.  Nothing stood out as being insecure and I'll say again that most of the documentation is very well done.

Below are some nits:

Appendix G

Current:
   This section provides anyone intending to define how to transport of
   RTSP messages over a unreliable transport protocol with some
   information learned by the attempt in RFC 2326 [RFC2326].  RFC 2326
   defined both an URI scheme and some basic functionality for transport
   of RTSP messages over UDP, however, it was not sufficient for
   reliable usage and successful interoperability.

   The RTSP scheme defined for unreliable transport of RTSP messages was
   "rtspu".  It has been reserved by this specification as at least one
   commercial implementation exists, thus avoiding any collisions in the
   name space.
   
   The following considerations should exist for operation of RTSP over
   an unreliable transport protocol:
   
Proposed:
   This appendix provides guidance for those who want to implement RTSP messages over unreliable transports as has been defined in RFC 2326 [RFC2326].  RFC 2326 defined the "rtspu" scheme and provided some basic information for the transport of RTSP messages over UDP.  The information is being provided here as there has been at at least one commercial implementation and compatibility with that should be maintained.
   
   The following points should be considered for an interoperable implementation:
   
   
   
CML> Throughout the document, I found an assortment of "an URI" and "a URI".  Please pick one and be consistent.  :-)

CML> Do you want to say something about using rtspu is NOT RECOMMENDED in the Security Considerations section?


Best regards,
Chris
________________________________________
From: Chris Lonvick (clonvick)
Sent: Friday, June 07, 2013 10:25 AM
To: Magnus Westerlund
Cc: [e-mail]; [e-mail]; [e-mail]
Subject: Re: Secdir review of draft-ietf-mmusic-rfc2326bis-34

Hi Magnus,

Unfortunately I did not review those sections. My travel with the day job lately has prevented me from doing that. I did want to get a review in before the deadline and what I did was all that I could accomplish right now.

I do have a long-ish flight coming up in a few days. If it would help, I could review those sections and have my notes out by next Wednesday or Thursday. Let me know.

Best regards,
Chris

Sent from my phone.

On Jun 7, 2013, at 8:17 AM, "Magnus Westerlund" <[e-mail]> wrote:

> Hi Chris,
>
> Did you review Section 19 - Security Framework and section C.1.4 which
> are the two major sections which defines usage of security mechanisms?
>
> Thanks,
>
> Magnus
>
> On 2013-06-06 18:37, Chris Lonvick (clonvick) wrote:
>> Hi,
>>
>> I have reviewed this document as part of the security directorate's
>> ongoing effort to review all IETF documents being processed by the
>> IESG.  These comments were written primarily for the benefit of the
>> security area directors.  Document editors and WG chairs should treat
>> these comments just like any other last call comments.
>>
>> This is a lengthy document and I did not have time to fully review
>> it.  I did review the Security Considerations section and found it to
>> be well written and thorough.  I found no problems there and consider
>> that it appropriately covers the concepts in the document.
>>
>> Thanks, Chris
>
>
> --
>
> Magnus Westerlund
>
> ----------------------------------------------------------------------
> Multimedia Technologies, Ericsson Research EAB/TVM
> ----------------------------------------------------------------------
> Ericsson AB                | Phone  [phone]
> Färögatan 6                | Mobile [phone]
> SE-164 80 Stockholm, Sweden| mailto: [e-mail]
> ----------------------------------------------------------------------
>