[secdir] SecDir review of draft-ietf-avtcore-rfc5285-bis-09

["Xialiang (Frank)" <[e-mail]>]

Hi,
I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.


This document provides a general mechanism to use the header extension feature of RTP (the Real-Time Transport Protocol). It provides the option to use a small number of small extensions in each RTP packet, where the universe of possible extensions is large and registration is de-centralized.  The actual extensions in use in a session are signaled in the setup information for that session.  This document obsoletes RFC5285.


The document appears in reasonably good shape.
As a whole, the Security Considerations section analyzes the possible threats to the RTP header extension mechanism, and gives the suitable solutions well.

But, there are still several open issues (TBDs) in the document that need to be completed before publication.
Below a series of my own comments, questions for your consideration.


Comments about the Security Considerations Section:

In fact, [RFC3264] also considers packet confidential protection by encrypting the packet bodies to protect against eavesdropping. This point is missed here.

While Secure Real-time Transport Protocol (SRTP) [RFC3711] covers the same security requirements and measures of RTP header extension mechanism of this draft, but some of its cryptographic algorithms are old and not updated, such as its default and mandatory-to-implement algorithms like: AES-CM and NULL for Encryption, HMAC-SHA1 for Message Authentication/Integrity and so on. Would you please consider to mention this issue in your draft and suggest to use the up to date and secure algorithms to adopt to internet of today. For example, AES-CCM/AES-GCM and HMAC-SHA2_256_128/HMAC-SHA2_512_256?



Editorial suggestions:

Title of section 6: it does not comply with the rule that the first alphabet is capital.

Setion 1: the last paragraph misses a ending "."

A section of Terminology is missed, since there are several words in the draft need this part.

Section 4.1.2: in third paragraph, there is a wrong word "dp", which should be "do".

Section 6: suggest to use "SDP Offer/Answer [RFC3264]" to replace "offer/answer [RFC3264]".


Thank you.


B.R.
Frank