Re: [secdir] Secdir review of draft-ietf-mmusic-duplication-grouping-03

["Ali C. Begen (abegen)" <[e-mail]>]

Hi Vincent,

On Nov 18, 2013, at 4:58 PM, Vincent Roca <[e-mail]> wrote:

> Hello,
> 
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors. Document editors and WG chairs should treat
> these comments just like any other last call comments.
> 
> IMHO, the document is Almost ready.
> 
> My main comment WRT this I-D is the following:
> 
> 1- There is no reference to RFC4566 (SDP) security section! This is a pity
> as the security considerations are very well addressed in this RFC, much
> better than in the present I-D I would say.
> Additionally, I don't think that adding duplication grouping to SDP changes
> so much the situation WRT SDP security, so this is one more reason to
> have this reference.

We can add this, no worries. I think we simply followed RFC 5888 in this section but your point is taken.

> 
> 
> Otherwise:
> 
> 2- The authors say that "there is a weak threat". Is the threat weak in the
> sense it is unlikely to happen (why?), or is it weak in the sense it will have
> limited consequences? In any case, I would be in favor of removing
> "weak" altogether.

It means it is unlikely to happen because if someone can modify the SDP for changing the grouping, it can actually do much worse things by changing other things. 

> 
> 3- Since we are now all aware of the necessity of making pervasive
> monitoring more  complex, it could be useful to say that having some
> confidentiality is recommended (in addition to integrity and authentication
> of course). This is not discussed in RFC4566 (but it was published in 2006),
> so it's worth mentioning it in this I-D (no need to say much).

Personally I dont think anything we say in this draft will have any impact in this regard but I can add this when doing the revision.

> 
> 
> Non security related comment:
> 
> 4- The [IC2011] reference should be updated. It's published, and the
> volume/number are now known.

Good point, I thought this was fixed. Thanks.

> 
> 
> Cheers,
> 
>    Vincent