Re: [secdir] Secdir review of draft-ietf-payload-rtp-aptx-04

["John Lindsay" <[e-mail]>]

Hi

Firstly apologies for the delay in replying, this is the first RFC draft
I have been involved with and I was not sure of the process.
You are correct the coded is a constant bit rate encoder and hence not
vulnerable to the methods described in in the
draft-ietf-avtcore-srtp-vbr-audio document.

If its felt necessary a note to this affect can be added to the security
considerations section.

Regards

John


-----Original Message-----
From: Tero Kivinen [mailto:[e-mail]] 
Sent: 05 December 2013 12:47
To: [e-mail]; [e-mail];
[e-mail]
Subject: Secdir review of draft-ietf-payload-rtp-aptx-04

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security
area directors.  Document editors and WG chairs should treat these
comments just like any other last call comments.

This document describes how to transmit proprietary audio codec
algorithms standard apt-X and enchanced apt-X in the RTP. The document
has security considerations section which seems to be OK.

If I have understood correctly the codec is constant bit rate codec,
thus it is not vulnerable to the traffic analysis attacks described for
example in the draft-ietf-avtcore-srtp-vbr-audio document. Perhaps the
security considerations section could note that these codecs are not
vulnerable to those attacks (if that is in deed true).
--
[e-mail]