Re: [Wish] WG Last Call for draft-ietf-wish-whip

[Adam Roach <[e-mail]>]

On 6/29/2022 9:31 AM, Sean Turner wrote:
> Hi! We are going to extend the WG last call period by two weeks because of the low number of reviews. Please note that you can also say that you are fine with the I-D progressing.


I think the document is nearly ready for the IESG to consider, once we 
have dispositions for the items that Julisz and Christer have raised (to 
be clear, I don't necessarily think we need changes for all of their 
raised points; just that we need to drive each one to conclusion).

I have submitted a PR with suggested editorial changes at 
<https://github.com/wish-wg/webrtc-http-ingest-protocol/pull/65>.

Aside from those editorial suggestions and a select few of the 
outstanding comments, the only concern I have is the length of the 
"Security Considerations" section: I guarantee that this document will 
not progress through IESG review without additional text. I think we 
need to address items such as:

* Sensitivity of authentication information, including how long 
authentication tokens should remain valid

* A brief discussion of the properties of media keys (e.g., the use of 
DTLS-SRTP means that media keying information is not visible to any HTTP 
intermediaries, such as TLS processors in CDNs)

* A discussion of potential resource exhaustion attacks if 
unauthenticated requests are allowed, along with mitigation suggestions

* The importance of servers requiring proper consent freshness 
processing to avoid certain classes of DDoS attacks

* Servers potentially limiting the number of simultaneous streams that 
can be sent with the same token, to prevent (e.g.) a user's 
authentication token being distributed widely and used in a DDoS attack 
that passes consent checks


/a