[Sframe] Paul Wouters' Discuss on draft-ietf-sframe-enc-07: (with DISCUSS)

[Paul Wouters via Datatracker <[e-mail]>]

Paul Wouters has entered the following ballot position for
draft-ietf-sframe-enc-07: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-sframe-enc/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

I have some questions that are likely easily answered and more indicative of my
lack of experience in streaming infrastructure.

1) KID and CTR encoding

Is there really much to be gained from the SFrame Header KID and CTR encoding
for small values? For example an audio or video stream would almost immediately
require the "extended encoding" for the CTR? I find it difficult to see the
advantage of this added complexity.

2) Tag size

What is the real gain of allowing shorter authentication tags? Even the
document itself states:

        Nonetheless, without these mitigations, an application that
        makes use of short tags will be at heightened risk of forgery
        attacks. In many cases, it is simpler to use full-size tags and
        tolerate slightly higher bandwidth usage rather than add the
        additional defenses necessary to safely use short tags.

Why not simplify on just 1 tag size?

3) IANA Considerations

Have you considered splitting the ciphersuites into a part that
requires standards action and a part that is specification required?

Related, have you considered using a RECOMMENDED column for ciphersuites,
where a RECOMMENDED=y can only be done via standards action?