Re: [secdir] [payload] sec-dir review of draft-ietf-payload-rtp-opus-08

[Kathleen Moriarty <[e-mail]>]

On Thu, Apr 9, 2015 at 10:21 AM, Ben Campbell <[e-mail]> wrote:

> On 9 Apr 2015, at 9:19, Derek Atkins wrote:
>
> > On Thu, April 9, 2015 10:07 am, Ben Campbell wrote:
> >> On 9 Apr 2015, at 9:00, Derek Atkins wrote:
> >>
> >>> Ben,
> >>>
> > [snip]
> >>> So you're suggesting (and would be okay with) this text:
> >>>
> >>> RTP packets using the payload format defined in this specification
> >>> are subject to the security considerations discussed in the RTP
> >>> specification RFC3550, and in any applicable RTP profile such as
> >>> RTP/AVP [RFC3551], RTP/AVPF [RFC4585], RTP/SAVP [RFC3711] or RTP/
> >>> SAVPF [RFC5124].  However, as "Securing the RTP Protocol Framework:
> >>> Why RTP Does Not Mandate a Single Media Security Solution"
> >>> [I-D.ietf-avt-srtp-not-mandatory] discusses it is not an RTP payload
> >>> formats responsibility to discuss or mandate what solutions are used
> >>> to meet the basic security goals like confidentiality, integrity and
> >>> source authenticity for RTP in general.  This responsibility lays on
> >>> anyone using RTP in an application.  They can find guidance on
> >>> available security mechanisms and important considerations in Options
> >>> for Securing RTP Sessions [I-D.ietf-avtcore-rtp-security-options].
> >>> Applications SHOULD use an appropriate strong security mechanism.
> >>>
> >>
> >> I am okay with that text.
> >>
> >>> I think I'm okay with this.  (I kind of prefer my previous wording,
> >>> "Applications SHOULD implement at least one of the strong security
> >>> measures suggested by those references" only because it suggests that
> >>> multiple mechanisms are okay, whereas this new wording seems to imply
> >>> choosing only one).
> >>
> >> How about "Applications SHOULD use one or more strong security
> >> mechanisms, as appropriate"?
> >
> > Clearly now we're just getting down to wordsmithing..  :)
>
> Yeah, we should probably let the authors wordsmith their own draft :-)
>
> >
> > How about "Applications SHOULD use one or more appropriate strong
> security
> > mechanisms"?  (The subclause "as apporpriate" feels to me like it could
> be
> > ignored, as in "well, using a strong security mechanism isn't
> > appropriate").  I think the goal is to make sure that "appropriate"
> > modifies the "strong security mechanism" and not the "SHOULD use"  ;)
> >
> > What say you?
>
> WFM
>

This text works for me as well.  Please let me know once the draft has been
updated and thanks for the discussion on this point.

Kathleen

>
> >
> > -derek
> >
> > --
> >      Derek Atkins                 617-623-3745
> >      [e-mail]             www.ihtfp.com
> >      Computer and Internet Security Consultant
>



-- 

Best regards,
Kathleen