Re: [Speermint] AD review: draft-ietf-speermint-voipthreats-05

[Gonzalo Camarillo <[e-mail]>]

Hi,

thanks for having submitted a new revision of this draft:

http://tools.ietf.org/html/draft-ietf-speermint-voipthreats-06

This revision addresses most of my comments below. However, I do not
think I got an answer to the following question:

> While message modification and eavesdropping is included in the
> threats against SF and MF, they do not seem to appear in the threats
> against LRF and LUF. Why?

Also, the reasons why Section 4.5 recommends TCP over UDP are still not
clear. UDP over DTLS would meet the requirements in both Sections 3.2
and 4.5.

Thanks,

Gonzalo


On 29/09/2010 5:15 PM, Gonzalo Camarillo wrote:
> Hi,
> 
> a couple of days ago I received a publication request for the following
> draft:
> 
> https://datatracker.ietf.org/doc/draft-ietf-speermint-voipthreats/
> 
> Here you have my AD review of the draft (see below). The authors should
> be able to address all my comments fairly quickly. As soon as they
> revise the draft I will initiate its IETF LC.
> 
> Thanks,
> 
> Gonzalo
> 
> 
> draft-ietf-speermint-voipthreats-05
> 
> Expand acronyms on their first use (e.g., SPEERMINT in the title and
> VoIP in the Introduction).
> 
> The Abstract and the Introduction attempt to explain the relationship
> between this draft and draft-ietf-speermint-requirements. However,
> Section 3.1 does a better job at that. Could you please clarify in the
> Introduction that the requirements in draft-ietf-speermint-requirements
> were derived from the threats documented in this draft? Also, please
> clarify that in addition to be the base for those requirements, this
> draft provides countermeasures to meet those requirements. Any SPEERMINT
> expert will probably understand that by reading the Abstract and the
> Introduction but clarifying those points will help readers who have not
> been that involved in the process.
> 
> While message modification and eavesdropping is included in the
> threats against SF and MF, they do not seem to appear in the threats
> against LRF and LUF. Why?
> 
> Section 4.5 recommends to use TCP instead of UDP. That advice is great,
> but the reasons Section 4.5 discusses are not that strong. The fact that
> the linux kernel has improved is irrelevant if an operator uses
> non-linux boxes. Also, an operator using UDP over IPsec, for instance,
> will not face the problems described there. The main recommendation in
> Section 4.5 seems to actually be to use an integrity protection
> mechanism. Clarifying that section would be useful.
> 
> [refs.sbcfuncs] has been published as RFC 5853
> 
> A few references only include the title and the author fields. Adding
> the venue where they were published would be useful.
>