Re: [secdir] [payload] sec-dir review of draft-ietf-payload-rtp-opus-08

["Derek Atkins" <[e-mail]>]

Ben,

On Thu, April 9, 2015 9:45 am, Ben Campbell wrote:
> On 9 Apr 2015, at 8:31, Derek Atkins wrote:
>
>> Colin Perkins <[e-mail]> writes:
>>
>>> I think "SHOULD use an appropriate strong security mechanism" is
>>> quite
>>> different to "SHOULD use SRTP", since we know of cases where SRTP
>>> isn't suitable. That was my objection to the original text.
>>
>> I'm fine with "SHOULD use an appropriate strong security mechanism",
>> which is what I tried to convey with my added sentence to the guidance
>> paragraph.
>
> I would be okay with "SHOULD use an appropriate strong security
> mechanism". I assume the intended difference is the removal of the "as
> suggested by those references" part.

So you're suggesting (and would be okay with) this text:

   RTP packets using the payload format defined in this specification
   are subject to the security considerations discussed in the RTP
   specification RFC3550, and in any applicable RTP profile such as
   RTP/AVP [RFC3551], RTP/AVPF [RFC4585], RTP/SAVP [RFC3711] or RTP/
   SAVPF [RFC5124].  However, as "Securing the RTP Protocol Framework:
   Why RTP Does Not Mandate a Single Media Security Solution"
   [I-D.ietf-avt-srtp-not-mandatory] discusses it is not an RTP payload
   formats responsibility to discuss or mandate what solutions are used
   to meet the basic security goals like confidentiality, integrity and
   source authenticity for RTP in general.  This responsibility lays on
   anyone using RTP in an application.  They can find guidance on
   available security mechanisms and important considerations in Options
   for Securing RTP Sessions [I-D.ietf-avtcore-rtp-security-options].
   Applications SHOULD use an appropriate strong security mechanism.

I think I'm okay with this.  (I kind of prefer my previous wording,
"Applications SHOULD implement at least one of the strong security
measures suggested by those references" only because it suggests that
multiple mechanisms are okay, whereas this new wording seems to imply
choosing only one).

-derek
-- 
       Derek Atkins                 617-623-3745
       [e-mail]             www.ihtfp.com
       Computer and Internet Security Consultant