Subject: [Sipbrandy] Comments on draft-peterson-sipbrandy-rtpsec-00

From: Alan Johnston <[email-masked]>
Date: Sun, 17 Jul 2016 01:55:16 -0700

All,

I've reviewed draft-peterson-sipbrandy-rtpsec-00 and have a few comments.

Overall, the content seems OK, although I'm surprised at the number of open
issues and Internet-Drafts referenced.  It is hard to believe that this is
our situation after 15 years of SIP (RFC 3261) and 12 years of SRTP (RFC
3711)...

Section 3.2 begins with:

   Work is already underway on defining approaches to opportunistic
   media security for SIP in [I-D.johnston-dispatch-osrtp], which builds
   on the prior efforts of [I-D.kaplan-mmusic-best-effort-srtp].

Instead of a reference to the Kaplan draft, which is already referenced and
credited in the OSRTP draft, perhaps it would be better to say:

   Work is already underway on defining approaches to opportunistic
   media security for SIP in [I-D.johnston-dispatch-osrtp], which reflects
   common industry implementations.

In Section 5, this statement:

   Both DTLS-SRTP and ZRTP instead provide hashes which are carried in SDP,
and
   thus require only integrity protection rather than confidentiality.

isn't quite accurate, since it implies that ZRTP requires integrity
protected signaling.  It would be better to say:

   DTLS-SRTP provides a hash which is carried in SDP, and
   thus requires only integrity protection rather than confidentiality.
   ZRTP can also provide a hash to make use of integrity protected
signaling,
   however, it does not rely on it.

One nit: The short title seems to be "RTP Security" - probably this should
mention SIP as well.

- Alan -

---

From: Gonzalo Camarillo <[email-masked]>
Date: Sun, 17 Jul 2016 12:49:03 +0200

Thanks Alan for getting the discussion started. The mailing list has
been very quiet so far.

All, it would be useful to start the conversations we need to have by
email in preparation for our face-to-face session this week.

Cheers,

Gonzalo

On 17/07/2016 10:55 AM, Alan Johnston wrote:
> Overall, the content seems OK, although I'm surprised at the number of
> open issues and Internet-Drafts referenced.  It is hard to believe that
> this is our situation after 15 years of SIP (RFC 3261) and 12 years of
> SRTP (RFC 3711)...
> 
> Section 3.2 begins with:
> 
> Instead of a reference to the Kaplan draft, which is already referenced
> and credited in the OSRTP draft, perhaps it would be better to say:
> 
>    Both DTLS-SRTP and ZRTP instead provide hashes which are carried in
> SDP, and
> One nit: The short title seems to be "RTP Security" - probably this
> should mention SIP as well.
> 
> - Alan -
> 
> 
> _______________________________________________
> Sipbrandy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sipbrandy
>