Re: [secdir] Review of draft-ietf-sip-media-security-requirements-07.txt

Hi Tero,

thnk you for the review, in version 08 we  addressed the points you
raised, except the numbering of the requirements. Nevertheless, we have
included references in section 3 that show, were the requirements are
explained  (section 5).

Reagards
	Steffen

> -----Original Message-----
> From: Tero Kivinen [mailto:kivinen@iki.fi] 
> Sent: Wednesday, October 29, 2008 1:37 PM
> To: 
> draft-ietf-sip-media-security-requirements-07@tools.ietf.org; 
> sip-chairs@tools.ietf.org
> Cc: secdir@ietf.org; iesg@ietf.org
> Subject: Review of draft-ietf-sip-media-security-requirements-07.txt
> Importance: High
> 
> I have reviewed this document as part of the security 
> directorate's ongoing effort to review all IETF documents 
> being processed by the IESG. These comments were written 
> primarily for the benefit of the security area directors. 
> Document editors and WG chairs should treat these comments 
> just like any other last call comments.
> 
> This draft talks about security requirements of the SIP 
> media. As such the whole document talks about security. I do 
> not have any security comments for it, but I have some other 
> comments and notes about it.
> 
> The biggest problem I had when I was reading the document, 
> was that section 3, suddenly starts listing different 
> requirements like R-PASS-MEDIA, R-PASS-SIG etc, and there is 
> no indication where those are described. I tried to look for 
> them in the table of contents, but couldn't find them listed there.
> 
> Reading forward I finally found those in the section 5, but 
> as they are not as separate sections there, they were not 
> listed in the table of contents. It would be better to move 
> each of those requirement to separate subsection, i.e. make 
> "5.1.1 R-FORK-RETARGET" and so on, so those references 
> earlier could point to section 5.1.1 and those would also be 
> listed in the table of contents.
> 
> There is also unexpanded acronym of UAC in section 4.2, and I 
> do not what it means and it is not expanded or described in 
> any way. There seemed to be also quite a lot of other 
> acronyms, so it would be useful to check out if those are 
> really described (or expanded) somewhere in the document.
> 
> Also it would be useful to expand HERFP also in the section 
> 5.1 when describing R-HERFP, not only section 4.2. Now the 
> description of R-HERFP does not tell that much: "The media 
> security key management protocol MUST function securely even 
> in the presence of HERFP behavior." especially if reader 
> doesn't remember what HERFP stands for...
> 
> The description of R-RTP-VALID seems bit odd. It says that 
> "...key negotiation packets MUST NOT pass the RTP validity 
> check...". That seems bit odd considering that the name is 
> R-RTP-VALID and it says MUST NOT pass validity check. Is that 
> description really correct?
> 
> Some nits:
> 
> Section 8. Acknowledgements has Richard Barnes twice.
> 
> Section A.4.3. SSRC and ROC has typo in word binding: 
> "Another, used by Security Descriptions, is to use "late 
> bindng" -- ...
> --
> kivinen@safenet-inc.com
> 
_______________________________________________
secdir mailing list
secdir@ietf.org
https://www.ietf.org/mailman/listinfo/secdir