Re: [secdir] [payload] sec-dir review of draft-ietf-payload-rtp-opus-08

["Ben Campbell" <[e-mail]>]

On 9 Apr 2015, at 9:00, Derek Atkins wrote:

> Ben,
>
> On Thu, April 9, 2015 9:45 am, Ben Campbell wrote:
>> On 9 Apr 2015, at 8:31, Derek Atkins wrote:
>>
>>> Colin Perkins <[e-mail]> writes:
>>>
>>>> I think "SHOULD use an appropriate strong security mechanism" is
>>>> quite
>>>> different to "SHOULD use SRTP", since we know of cases where SRTP
>>>> isn't suitable. That was my objection to the original text.
>>>
>>> I'm fine with "SHOULD use an appropriate strong security mechanism",
>>> which is what I tried to convey with my added sentence to the 
>>> guidance
>>> paragraph.
>>
>> I would be okay with "SHOULD use an appropriate strong security
>> mechanism". I assume the intended difference is the removal of the 
>> "as
>> suggested by those references" part.
>
> So you're suggesting (and would be okay with) this text:
>
>  RTP packets using the payload format defined in this specification
>  are subject to the security considerations discussed in the RTP
>  specification RFC3550, and in any applicable RTP profile such as
>  RTP/AVP [RFC3551], RTP/AVPF [RFC4585], RTP/SAVP [RFC3711] or RTP/
>  SAVPF [RFC5124].  However, as "Securing the RTP Protocol Framework:
>  Why RTP Does Not Mandate a Single Media Security Solution"
>  [I-D.ietf-avt-srtp-not-mandatory] discusses it is not an RTP payload
>  formats responsibility to discuss or mandate what solutions are used
>  to meet the basic security goals like confidentiality, integrity and
>  source authenticity for RTP in general.  This responsibility lays on
>  anyone using RTP in an application.  They can find guidance on
>  available security mechanisms and important considerations in Options
>  for Securing RTP Sessions [I-D.ietf-avtcore-rtp-security-options].
>  Applications SHOULD use an appropriate strong security mechanism.
>

I am okay with that text.

> I think I'm okay with this.  (I kind of prefer my previous wording,
> "Applications SHOULD implement at least one of the strong security
> measures suggested by those references" only because it suggests that
> multiple mechanisms are okay, whereas this new wording seems to imply
> choosing only one).

How about "Applications SHOULD use one or more strong security 
mechanisms, as appropriate"?

>
> -derek
> -- 
>      Derek Atkins                 617-623-3745
>      [e-mail]             www.ihtfp.com
>      Computer and Internet Security Consultant