Re: [secdir] Secdir review of draft-ietf-avtcore-rtp-scip-02

["[e-mail]" <[e-mail]>]

Magnus,

Access to the SCIP standards has been discussed many times over the Draft RFC process.   The AVTCORE resolution was to treat SCIP as an opaque standard similar to RFC 8817 (TSVCIS) which also references SCIP-210. The documents are now under the control of NATO and available for those that need to know.  Before our involvement in the IETF, that was Gov't and SCIP product manufacturers.  Some older versions were made publicly available. However, in general, they have never been publicly available.

The purpose of the IETF draft RFC is to let the globally community know that the codecs necessary to support SCIP are registered as media subtypes and the encrypted information carried in those media subtypes should pass transparently thorough their network.

The inclusion of the email address to NATO is a way request SCIP 210 and that process has been slow, but has worked.  The requests may take days to process.  As for a "definition of the protocol", it is a SCIP device to SCIP device application layer security protocol as defined in SCIP-210.

Regarding the Security Considerations, SCIP does not introduce any new vulnerabilities to an RTP stream.

Michael Faller
Dan Hanson

GENERAL DYNAMICS Mission Systems

This message and/or attachments may include information subject to GDC4S S.P. 1.8.6 and GD Corporate Policy 07-105 and are intended to be accessed only by authorized recipients.  Use, storage and transmission are governed by General Dynamics and its policies. Contractual restrictions apply to third parties.  Recipients should refer to the policies or contract to determine proper handling.  Unauthorized review, use, disclosure or distribution is prohibited.  If you are not an intended recipient, please contact the sender and destroy all copies of the original message.




From: Magnus Nyström <[e-mail]>
Sent: Wednesday, August 31, 2022 1:04 AM
To: [e-mail]; [e-mail]
Subject: Secdir review of draft-ietf-avtcore-rtp-scip-02

External E-mail --- CAUTION: This email originated from outside GDMS. Do not click links or open attachments unless you recognize the sender and know the content is safe.


I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other comments.

The above mentioned draft describes the RTP payload format of the "Secure Communication Interoperability Protocol" as audio and video media subtypes, with corresponding media subtype definitions.

While the draft as such only provides the payload formats, it seems strange to have an Internet-Draft fully dependent on a protocol which isn't even referenced in the memo. SCIP is mentioned several times, but there's no reference to the definition of the protocol. The only reference is to a "SCIP SIgnaling Plan", but access to that document appears to require an email-based request to a NATO email address. Should such a document become a Standards-track RFC?

The Security Considerations section only talks about possible complexity introduced by the new media subtypes, which may be adequate, but does not discuss general considerations to take in the context of supporting SCIP. To my earlier comment, if SCIP itself isn't readily available, there seems to be a gap here.

Thanks,
-- Magnus