Re: [Simple] Draft new version: draft-ietf-simple-msrp-cema-06

[Nancy Greene <[e-mail]>]

The new text looks fine.
Nancy


www.ericsson.com  - This Communication is Confidential. We only send and receive email on the basis of the term set out at www.ericsson.com/email_disclaimer  


On Jun 29, 2012, at 3:47 PM, "Ben Campbell" <[e-mail]> wrote:

> (As Chair, adding to the previous...)
> 
> Christer also proposed the following change to section 7.7 to go along with the previous proposed addition:
> 
>>> Section 7.7 currently says:
>>> 
>>>    "There is no way for the endpoints to discover when such an attack is
>>>    taking place though."
>>> 
>>> I guess we should change that to something like:
>>> 
>>>    "It is very hard for the endpoints to detect when such an attack is
>>>    taking place though."
>> 
> 
> 
> If anyone objects to that change, please speak up ASAP.
> 
> 
> Thanks!
> 
> Ben.
> 
> 
> On Jun 27, 2012, at 3:33 PM, Ben Campbell wrote:
> 
>> As Chair:
>> 
>> Hi Everyone:
>> 
>> Christer, thanks for submitting this.
>> 
>> Everyone,  please take a quick look at the security considerations in this version, and send comments ASAP if you see an issue. If you made comments in the WGLC, please confirm whether your comments are addressed (I'm not sure if anyone but me did--maybe Paul?). If we don't see an objection the end of the week, we plan to restart the process to progress this.
>> 
>> Additionally, we've had a Security AD suggestion to add text (probably to section 7.7)  to the effect of the following, which would add SHOULD level normative requirements to watch for changes in a fingerprint for an identity, and warn of any changes. If anyone objects to adding that, please speak up ASAP.
>> 
>>> "When a UA receives a fingerprint, that represents a binding between 
>>> the identity as established by TLS and that established via SDP. As 
>>> previously noted, the fingerprint is vulnerable to an active MITM 
>>> attack from any on-path proxy. UAs SHOULD therefore locally store 
>>> fingerprints associated with the relevant identities when first 
>>> seen, and SHOULD warn when a new fingerprint is seen for what 
>>> otherwise appears to be the same peer identity. While there are 
>>> valid reasons for keys to change from time to time, that ought be 
>>> the exception, hence the suggested warning."
>> 
>> 
>> 
>> Thanks!
>> 
>> Ben.
>> 
>> 
>> 
>> 
>> On Jun 25, 2012, at 6:07 PM, Christer Holmberg wrote:
>> 
>>> Hi,
>>> 
>>> Based on Ben's comments, I've submitted a new version (-06) of the cema draft, with some modifications in the security considerations section. The new text should address Ben's issues and suggestions.
>>> 
>>> Regards,
>>> 
>>> Christer
>>> _______________________________________________
>>> Simple mailing list
>>> [e-mail]
>>> https://www.ietf.org/mailman/listinfo/simple
>> 
>> _______________________________________________
>> Simple mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/simple
> 
> _______________________________________________
> Simple mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/simple
_______________________________________________
Simple mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/simple