Re: [secdir] secdir review of draft-hanes-dispatch-fax-capability-06

David Hanes <dhanes@cisco.com> Fri, 11 January 2013 03:31 UTC

Mime-Version: 1.0 (Apple Message framework v1085)
Content-Type: text/plain; charset="us-ascii"
From: David Hanes <dhanes@cisco.com>
In-Reply-To: <ldv7go4glep.fsf@cathode-dark-space.mit.edu>
Date: Thu, 10 Jan 2013 22:31:49 -0500
Content-Transfer-Encoding: quoted-printable
Message-Id: <C8781758-5A98-4221-8B20-B5AD954FC4DA@cisco.com>
References: <ldv7go4glep.fsf@cathode-dark-space.mit.edu>
To: Tom Yu <tlyu@MIT.EDU>
Cc: secdir@ietf.org, Kevin Fleming <kevin@kpfleming.us>, Gonzalo Camarillo <Gonzalo.Camarillo@ericsson.com>, Gonzalo Salgueiro <gsalguei@cisco.com>, iesg@ietf.org, draft-hanes-dispatch-fax-capability.all@tools.ietf.org
Subject: Re: [secdir] secdir review of draft-hanes-dispatch-fax-capability-06
Precedence: list

Hi Tom,

Sorry for the delayed response but thanks for your review and feedback on the document.  This media feature tag has the effect of explicitly indicating a call *preference* to be fax; but there is no guarantee that it will end up that way (the re-INVITE SIP message later in the call flow is a much more accurate predictor that a call is of type fax).  Your question is reasonable since that simple fact could still seemingly simplify targeted attacks because chances are improved that the resultant call is indeed fax.  The truth is that SIP and SDP have various such media identification features so this is a persistent issue. Secondly, the reason for the umbrella reference to RCFC 3840 is that ANY media feature tag will be an explicitly indication of preference for a particular media type (speech, text, etc.). This draft merely registers a new value in a long list of other media feature tags but doesn't introduce any new Security Considerations that those others wouldn't have to address through the standard recommended privacy mechanisms (e.g., encryption, obfuscation, etc.). 

Regards,
David

On Dec 26, 2012, at 11:37 PM, Tom Yu wrote:

> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors.  Document editors and WG chairs should treat
> these comments just like any other last call comments.
> 
> This document describes a SIP media feature tag for indicating support
> for fax calls.
> 
> The Security Considerations section of this document refers to the
> Security Considerations documented in Section 11.1 of RFC 3840.  This
> seems mostly adequate.  One additional question (which might be
> irrelevant because of my unfamiliarity with SIP) is whether an
> explicit indication of fax content would make it easier for an
> eavesdropper to target fax image data (which might contain sensitive
> information such as credit card numbers).

[secdir] secdir review of draft-hanes-dispatch-fa… Tom Yu
Re: [secdir] secdir review of draft-hanes-dispatc… David Hanes