Re: [Sipbrandy] Comments on draft-peterson-sipbrandy-rtpsec-00

Thanks Alan for getting the discussion started. The mailing list has
been very quiet so far.

All, it would be useful to start the conversations we need to have by
email in preparation for our face-to-face session this week.

Cheers,

Gonzalo

On 17/07/2016 10:55 AM, Alan Johnston wrote:
> All,
> 
> I've reviewed draft-peterson-sipbrandy-rtpsec-00 and have a few comments.
> 
> Overall, the content seems OK, although I'm surprised at the number of
> open issues and Internet-Drafts referenced.  It is hard to believe that
> this is our situation after 15 years of SIP (RFC 3261) and 12 years of
> SRTP (RFC 3711)...
> 
> Section 3.2 begins with:
> 
>    Work is already underway on defining approaches to opportunistic
>    media security for SIP in [I-D.johnston-dispatch-osrtp], which builds
>    on the prior efforts of [I-D.kaplan-mmusic-best-effort-srtp].
> 
> Instead of a reference to the Kaplan draft, which is already referenced
> and credited in the OSRTP draft, perhaps it would be better to say:
> 
>    Work is already underway on defining approaches to opportunistic
>    media security for SIP in [I-D.johnston-dispatch-osrtp], which reflects
>    common industry implementations.
> 
> In Section 5, this statement:
> 
>    Both DTLS-SRTP and ZRTP instead provide hashes which are carried in
> SDP, and
>    thus require only integrity protection rather than confidentiality.
> 
> isn't quite accurate, since it implies that ZRTP requires integrity
> protected signaling.  It would be better to say:
> 
>    DTLS-SRTP provides a hash which is carried in SDP, and
>    thus requires only integrity protection rather than confidentiality.
>    ZRTP can also provide a hash to make use of integrity protected
> signaling,
>    however, it does not rely on it.
> 
> One nit: The short title seems to be "RTP Security" - probably this
> should mention SIP as well.
> 
> - Alan -
> 
> 
> _______________________________________________
> Sipbrandy mailing list
> Sipbrandy@ietf.org
> https://www.ietf.org/mailman/listinfo/sipbrandy
> 