[Speermint] AD review: draft-ietf-speermint-voipthreats-05

[Gonzalo Camarillo <[e-mail]>]

Hi,

a couple of days ago I received a publication request for the following
draft:

https://datatracker.ietf.org/doc/draft-ietf-speermint-voipthreats/

Here you have my AD review of the draft (see below). The authors should
be able to address all my comments fairly quickly. As soon as they
revise the draft I will initiate its IETF LC.

Thanks,

Gonzalo


draft-ietf-speermint-voipthreats-05

Expand acronyms on their first use (e.g., SPEERMINT in the title and
VoIP in the Introduction).

The Abstract and the Introduction attempt to explain the relationship
between this draft and draft-ietf-speermint-requirements. However,
Section 3.1 does a better job at that. Could you please clarify in the
Introduction that the requirements in draft-ietf-speermint-requirements
were derived from the threats documented in this draft? Also, please
clarify that in addition to be the base for those requirements, this
draft provides countermeasures to meet those requirements. Any SPEERMINT
expert will probably understand that by reading the Abstract and the
Introduction but clarifying those points will help readers who have not
been that involved in the process.

While message modification and eavesdropping is included in the
threats against SF and MF, they do not seem to appear in the threats
against LRF and LUF. Why?

Section 4.5 recommends to use TCP instead of UDP. That advice is great,
but the reasons Section 4.5 discusses are not that strong. The fact that
the linux kernel has improved is irrelevant if an operator uses
non-linux boxes. Also, an operator using UDP over IPsec, for instance,
will not face the problems described there. The main recommendation in
Section 4.5 seems to actually be to use an integrity protection
mechanism. Clarifying that section would be useful.

[refs.sbcfuncs] has been published as RFC 5853

A few references only include the title and the author fields. Adding
the venue where they were published would be useful.