[siprec] Stephen Farrell's Discuss on draft-ietf-siprec-metadata-20: (with DISCUSS and COMMENT)

["Stephen Farrell" <[e-mail]>]

Stephen Farrell has entered the following ballot position for
draft-ietf-siprec-metadata-20: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-siprec-metadata/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------



(1) In section 10 you have a MUST for integrity and confid,
which is good, but then RECOMMEND S/MIME, which is, I think,
mythical. Wouldn't it be better to reflect reality
(hop-by-hop TLS) and then say what actual security
considerations arise, e.g. who might be on the path and how
can they (mis)behave?

(2) 6.10: Don't you need to say to use UUID version 4 with
random numbers and to not use MAC addresses?  IOW, refer to
RFC4122, Section 4.4 for how to generate UUIDs. 

Note that issues related to both of the above were part
of the discussion that ensued from the secdir review. [1]

   [1] https://www.ietf.org/mail-archive/web/secdir/current/msg06370.html


----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------



- section 4, last para: How could an SRC know this and hence
what it's safe to omit?

- 6.9: I would have thought that more precision about
fractional seconds support would be useful here, or else, to
just say that you're limiting to single-second granularity.
Wouldn't doing one or the other be better? Otherwise you
might get different s/w ordering events in different orders
unexpectedly.