Re: [sipcore] AD Review: draft-ietf-sipcore-digest-scheme

[Rifaat Shekh-Yusef <[e-mail]>]

Thanks Adam!

I will fix these issues in the next version of the draft.

Regards,
 Rifaat



On Thu, Aug 29, 2019 at 6:11 PM Adam Roach <[e-mail]> wrote:

> This is my AD review for draft-ietf-sipcore-digest-scheme.
>
> First of all, I want to thank to everyone who put work into making
> this happen. It's good to be putting in place a more secure
> authentication mechanism.
>
> I find no showstoppers in this version of the document, and will be
> requesting
> IETF last call on it shortly. I did find some minor issues, described
> below,
> that should be treated the same as any other last call comments.
>
> /a
>
> ---------------------------------------------------------------------------
>
> §1.1:
>
> Please update to use the boilerplate in RFC 8174.
>
> ---------------------------------------------------------------------------
>
> §2.5:
>
>  >  The
>  >  ordering of the header field values from the various proxies is not
>  >  significant.
>
> The phrasing here is a bit confusing, and can be read as contradicting the
> sentence it follows. I believe what you mean to say can be conveyed with
> something more like:
>
>     The ordering of values received from proxies relative to values
>     received from other proxies is not significant.
>
> ---------------------------------------------------------------------------
>
> §2.6:
>
>  >  1.  The URI included in the challenge has the following BNF:
>
> Please cite RFC 5234.
>
> ---------------------------------------------------------------------------
>
> §3:
>
>  >  This opens the system to the potential of a downgrade attack by man-
>  >  in-the-middle.
>
> The phrasing here is a bit awkward. I might suggest rephrasing as:
> "...a downgrade attack by an on-path attacker."
>
>
>