Re: [secdir] secdir review of draft-ietf-xrblock-rtcp-xr-post-repair-loss-count-07

["Huangyihong (Rachel)" <[e-mail]>]

Hi Scott,

Thanks for your suggestions. I'll remove "It is believed that" from current draft.

BR,
Rachel

> -----Original Message-----
> From: Scott Kelly [mailto:[e-mail]]
> Sent: Monday, December 22, 2014 9:53 PM
> To: [e-mail]; [e-mail];
> [e-mail]
> Subject: secdir review of draft-ietf-xrblock-rtcp-xr-post-repair-loss-count-07
> 
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG.  These
> comments were written primarily for the benefit of the security area directors.
> Document editors and WG chairs should treat these comments just like any
> other last call comments.
> 
> Here's the abstract:
> 
>    This document defines an RTP Control Protocol (RTCP) Extended Report
>    (XR) Block that allows reporting of post-repair loss count metrics
>    for a range of RTP applications.
> 
> Prior to this mechanism, RTCP Sender Reports (SR)/Receiver Reports (RR)
> contain, among other things, the cumulative number of packets lost. That
> number doesn't indicate the data successfully received, because the receiver
> can apply repair mechanisms to recover data. This document adds reporting for
> post-repair metrics.
> 
> The security considerations seem complete, but I have one nit. Here's the first
> sentence:
> 
>    It is believed that this RTCP XR block introduces no new security
>    considerations beyond those described in [RFC3611].
> 
> Who believes this? I would simply assert this (remove "It is believed that"),
> and if I wasn't comfortable with that, I'd take that as an indication that more
> analysis is required.
> 
> -Scott
> 
>