Re: [secdir] Secdir review of draft-ietf-payload-rtp-aptx-04

[Tero Kivinen <[e-mail]>]

John Lindsay writes:
> Firstly apologies for the delay in replying, this is the first RFC draft
> I have been involved with and I was not sure of the process.
> You are correct the coded is a constant bit rate encoder and hence not
> vulnerable to the methods described in in the
> draft-ietf-avtcore-srtp-vbr-audio document.
> 
> If its felt necessary a note to this affect can be added to the security
> considerations section.

Either way is good for me. 

> -----Original Message-----
> From: Tero Kivinen [mailto:[e-mail]] 
> Sent: 05 December 2013 12:47
> To: [e-mail]; [e-mail];
> [e-mail]
> Subject: Secdir review of draft-ietf-payload-rtp-aptx-04
> 
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the IESG.
> These comments were written primarily for the benefit of the security
> area directors.  Document editors and WG chairs should treat these
> comments just like any other last call comments.
> 
> This document describes how to transmit proprietary audio codec
> algorithms standard apt-X and enchanced apt-X in the RTP. The document
> has security considerations section which seems to be OK.
> 
> If I have understood correctly the codec is constant bit rate codec,
> thus it is not vulnerable to the traffic analysis attacks described for
> example in the draft-ietf-avtcore-srtp-vbr-audio document. Perhaps the
> security considerations section could note that these codecs are not
> vulnerable to those attacks (if that is in deed true).
> --
> [e-mail]

-- 
[e-mail]