[secdir] Review of draft-ietf-avt-rtp-toffset-07

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors. Document editors and WG chairs should treat 
these comments just like any other last call comments.

This draft describes a way to inference information between transmission 
of a packet vs RTP timestamp data.  This could be used to determine 
actual network jitter and the draft describes a new packet for reporting 
this data.

The security consideration section does exist and consists of one sentence:

   The given transmission offsets are only informative and it is hard to
   see security considerations from associating them with media streams.

I believe more guidance would help here.  For instance; security 
considerations should be made based on how applications act upon network 
jitter information and if the attribute is determined to be sensitive to 
a DoS attack, for instance, then protecting this information should be 
made.  Referring to recommendations outlined in the RTP RFC or better.

Other than that, I see no additional security concerns from that of RTP.

Editorial comment(s):
None.

Shawn.
--
_______________________________________________
secdir mailing list
secdir@mit.edu
https://mailman.mit.edu/mailman/listinfo/secdir
_______________________________________________
secdir mailing list
secdir@ietf.org
https://www.ietf.org/mailman/listinfo/secdir