Re: [secdir] [payload] sec-dir review of draft-ietf-payload-rtp-opus-08

[Colin Perkins <[e-mail]>]

On 9 Apr 2015, at 11:04, Stephen Farrell <[e-mail]> wrote:
> I do agree with Colin here (and with Ben and Robert) but...
> 
> On 09/04/15 10:58, Colin Perkins wrote:
>> A document giving normative security guidance for unicast SIP-based
>> telephony using RTP is something we need, I agree. I'm happy to help
>> reviewing such a thing, but it should be authored by someone more
>> familiar with the deployed security mechanisms.
> 
> I've just gotten offlist mail from another secdir reviewer who
> noted that we had exactly the same discussion 7 years ago for
> another payload document. And I recall it myself more recently.

We've been around this loop multiple times. That's why we wrote RFCs 7201 and 7202, to try to stop repeating the same discussion by explaining the issues and providing guidance. The recommended text for new RTP payload formats in the rtp-howto was also intended to help clarify. Clearly something more is needed. If the issue is that RFC7202 isn't clear, then I'm happy to work with someone to clarify in an update, but I suspect we need the suggested documents giving normative requirements for different application classes.

> So that unicast SIP/RTP document really would save us all some
> time and might help those implementing and deploying security
> stuff in such cases. (And even if folks were not implementing
> or deploying security stuff for this 7 years ago, I would say
> that it's much more likely they will be doing that today and
> in future.)

Agreed.

-- 
Colin Perkins
https://csperkins.org/