[Sipbrandy] Comments on draft-peterson-sipbrandy-rtpsec-00

[Alan Johnston <[e-mail]>]

All,

I've reviewed draft-peterson-sipbrandy-rtpsec-00 and have a few comments.

Overall, the content seems OK, although I'm surprised at the number of open
issues and Internet-Drafts referenced.  It is hard to believe that this is
our situation after 15 years of SIP (RFC 3261) and 12 years of SRTP (RFC
3711)...

Section 3.2 begins with:

   Work is already underway on defining approaches to opportunistic
   media security for SIP in [I-D.johnston-dispatch-osrtp], which builds
   on the prior efforts of [I-D.kaplan-mmusic-best-effort-srtp].

Instead of a reference to the Kaplan draft, which is already referenced and
credited in the OSRTP draft, perhaps it would be better to say:

   Work is already underway on defining approaches to opportunistic
   media security for SIP in [I-D.johnston-dispatch-osrtp], which reflects
   common industry implementations.

In Section 5, this statement:

   Both DTLS-SRTP and ZRTP instead provide hashes which are carried in SDP,
and
   thus require only integrity protection rather than confidentiality.

isn't quite accurate, since it implies that ZRTP requires integrity
protected signaling.  It would be better to say:

   DTLS-SRTP provides a hash which is carried in SDP, and
   thus requires only integrity protection rather than confidentiality.
   ZRTP can also provide a hash to make use of integrity protected
signaling,
   however, it does not rely on it.

One nit: The short title seems to be "RTP Security" - probably this should
mention SIP as well.

- Alan -