Subject: Re: [Sipbrandy] Tsvart last call review of draft-ietf-sipbrandy-osrtp-09

From: Andy Hutton <[email-masked]>
Date: Mon, 17 Jun 2019 16:37:21 +0100

On Fri, 17 May 2019 at 04:48, Allison Mankin via Datatracker
<[email-masked]> wrote:
>
> Reviewer: Allison Mankin
> Review result: Ready with Nits
>
> This document has been reviewed as part of the transport area review team's
> ongoing effort to review key IETF documents. These comments were written
> primarily for the transport area directors, but are copied to the document's
> authors and WG to allow them to address any issues raised and also to the IETF
> discussion list for information.
>
> When done at the time of IETF Last Call, the authors should consider this
> review as part of the last-call comments they receive. Please always CC
> [email-masked] if you reply to or forward this review.
>
> This document doesn't raise any specifically transport-focused questions
> for me.  I appreciated the clear discussion of the types of security
> arrangements that can be made by Offer-Answer SIP and I found the draft
> a valuable read.  The implementation section is quite interesting.
>
> I have a couple of issues with Section 4, though they are not about transport.
> So I'm going to mention them, but defer to the Security Area beyond just
> flagging them. Hence, I've marked the draft Ready with Nits rather than
> Ready with Issues.
>
> 1. I find the two sentences below inconsistent with each other, with a small-m
> "must" and a cited "SHOULD" for the same issue:
>
>       For SDP Security Descriptions key agreement [RFC4568], an
>       authenticated signaling channel does not need to be used with
>       OSRTP if it is not available, although an encrypted signaling
>       channel must still be used.
>
>       Section 8.3 of [RFC7435] requires that any messages that contain SRTP keys be
>       encrypted, and further says that encryption "SHOULD" provide end-to-
>       end confidentiality protection if intermediaries that could inspect
>       the SDP message are present.
>

The "must" will be changed to "MUST".

> Also, there isn't a section 8.3 of RFC7435.  Is this an incorrect reference or a reference
> to a pre-publication version of RFC7435?
>

The reference is incorrect it should be RFC 4568, good catch.

> 2. I feel the sentence below misrepresents RFC7435 with its wording "requirement
> for end-to-end confidentiality."  RFC7435 has a preference for confidentiality of
> authentication if there is authentication, but TOFU means there isn't a requirement.
> The sentence is too general.
>
>    At the time of this writing, it is
>    understood that the [RFC7435] requirement for end-to-end
>    confidentiality protection is commonly ignored.
>

Again it is the reference that is incorrect it should be RFC 4568.

> Editorial/Nits
> The section 4 reference to section 8.3 of RFC7435 needs to be fixed.
>
okay, thanks.

---

From: Allison Mankin <[email-masked]>
Date: Mon, 17 Jun 2019 14:43:51 -0400

Thank you for taking these comments. All good. The Sec Dir reviewer (Sean)
also spoke to my comment, and your response is consistent with what he
wrote.