Re: [Tsv-art] Tsvart last call review of draft-ietf-perc-private-media-framework-08

["Paul E. Jones" <[e-mail]>]

Gorry,

Thanks for your review.  Please see comment/questions in-line.

>General comments
>
>Some keywords appear not defined before first used - whilst these are likely
>to be well-known by the coimmunity of interest, it would none-the-less
>be helpful to define these:
>
>SRTP; RTCP; SIP; SDP.

Most of these have a reference that follows them (RTCP was the one 
exception, I think). Are you saying we should fully state what SRTP 
stands for, for example, or are you saying references were missing?


>In section 8.1, there is a sentence starting "Off-path atttackers may" ... while this
>is lower case, the authors may wish toi consider using "could" to remove any
>possibility of this being regarded as permissive.

Agreed. Changed as suggested.

>In 8.1, the text "could incorrectly assuming their packets..." probably ought to
>read could incorrectly assume their packets..."

Thanks. Fixed that and another small grammatical error there.

>In section 8.2.1. there is a dscription of a resource consumption attack, but
>no miitigation is described. It could be possible to consider using  rate-limiting
>of requests to reduce the impact - a mthod commonly suggested in other
>attacks on the transport endpoints
Good point. We cannot stop this entirely, but there are certainly 
implementation-specific approaches that could be employed.

I appended that paragraph with the following:

"While resource consumption attacks cannot be mitigated entirely, 
rate-limiting packets might help reduce the effectiveness of such 
attacks."

I'm open to alternative wording, but I think that should suffice.

Thanks,
Paul