Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Date: Thu, 9 Jul 2009 15:48:56 -0500
Message-ID: <1ECE0EB50388174790F9694F77522CCF1EE8AAC1@zrc2hxm0.corp.nortel.com>
In-Reply-To: <EE02487B-63DE-4CC6-81A9-7A4FAAD4A76D@standardstrack.com>
Thread-Topic: [RAI] RAI review of draft-ietf-speechsc-mrcpv2-19
thread-index: AcoA08qFd1S0dvASReCM8f8AHQdPFgAAoe5A
References: <033101c9ff3a$cbe33160$63a99420$%roni@huawei.com>
 <EE02487B-63DE-4CC6-81A9-7A4FAAD4A76D@standardstrack.com>
From: "Francois Audet" <audet@nortel.com>
To: "Eric Burger" <eburger@standardstrack.com>,
 "Roni Even" <Even.roni@huawei.com>
Cc: speechsc@ietf.org, Saravanan Shanmugham <sarvi@cisco.com>, rai@ietf.org
Subject: Re: [Speechsc] [RAI] RAI review of draft-ietf-speechsc-mrcpv2-19
Precedence: list

Eric,

I think you need to clarify the context of the following statement you=20
made: "The reality is that NO ONE has implemented any security to=20
date."

Certainly, SRTP is widely implemented and deployed in many environements
(e.g., Enteprise telephony for example).

I am assuming that your comment was specific to MRCPv2?

> -----Original Message-----
> From: rai-bounces@ietf.org [mailto:rai-bounces@ietf.org] On=20
> Behalf Of Eric Burger
> Sent: Thursday, July 09, 2009 13:28
> To: Roni Even
> Cc: Daniel Burnett; speechsc@ietf.org; Saravanan Shanmugham;=20
> rai@ietf.org
> Subject: Re: [RAI] RAI review of draft-ietf-speechsc-mrcpv2-19
>=20
> The reality is that NO ONE has implemented any security to=20
> date. The GENART reviewer raised the same issue, and so far=20
> the work group has the same response: MRCPv2 (the speechsc=20
> work group) is not planning on figuring out which of the=20
> seven key exchange mechanisms to use in SIP.  We are counting=20
> on the community publishing something, and people using it. =20
> After all, we are the "using SIP for media resource control"=20
> work group, not the "media resource control work group using=20
> something like SIP for control."
>=20
> Does this work for you?
>=20
> On Jul 7, 2009, at 3:40 PM, Roni Even wrote:
>=20
> > [snip]
> >
> >
> > 18.   In section 12.3 the suggestion is to use SRTP as the=20
> mandatory =20
> > interoperability mode. If the reason for mandating SRTP is for a=20
> > common mode you should also decide on a key exchange mechanism. I=20
> > suggest you look=20
> > athttp://tools.ietf.org/html/draft-ietf-avt-srtp-not-mandatory-02
> >  for discussion on media security.
>=20
>=20