Re: [secdir] review of draft-ietf-mmusic-connectivity-precon-06

[Stephen Kent <[e-mail]>]

I re-reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  In the re-review I examined only on the text that the authors 
said was changed in response to my comments.

In my initial review I said that the text about using suitable 
authentication and integrity mechanisms in this context was too vague 
to be useful and hat it should cite specific recommendations (via 
RFCs).

The authors have revised the relevant text and it is better. The 
revised text elicited a comment from Sam Hartman that SIP Identity 
(RFC 4474) should be cited. I agree with this suggestion, but believe 
that the current cite for using S/MIME with SDP [RFC 3261] also 
should be retained, until such time as the RAI area decides to move 
it to historical.

I think the expanded discussion of DoS concerns is better as well, 
even though no explicit threat model has been provided.

I did note a grammatical error:

"This attack would result in a poor user's experience ..."  ->

"This attack would result in a poor user experience ..."

Steve