Subject: Re: [sipcore] AD Review: draft-ietf-sipcore-digest-scheme

From: Adam Roach <[email-masked]>
Date: Mon, 16 Sep 2019 23:54:46 -0500

The last call on this document has concluded, and I see no comments 
other than my own AD review. As soon as a new version of the document is 
in the repository, I'll get it scheduled on the next telechat. Thanks!

/a

On 8/29/19 5:41 PM, Rifaat Shekh-Yusef wrote:
> Thanks Adam!
>
> I will fix these issues in the next version of the draft.
>
> Regards,
>  Rifaat
>
>
>
> On Thu, Aug 29, 2019 at 6:11 PM Adam Roach <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     This is my AD review for draft-ietf-sipcore-digest-scheme.
>
>     First of all, I want to thank to everyone who put work into making
>     this happen. It's good to be putting in place a more secure
>     authentication mechanism.
>
>     I find no showstoppers in this version of the document, and will be
>     requesting
>     IETF last call on it shortly. I did find some minor issues,
>     described below,
>     that should be treated the same as any other last call comments.
>
>     /a
>
>     ---------------------------------------------------------------------------
>
>     §1.1:
>
>     Please update to use the boilerplate in RFC 8174.
>
>     ---------------------------------------------------------------------------
>
>     §2.5:
>
>      >  The
>      >  ordering of the header field values from the various proxies
>     is not
>      >  significant.
>
>     The phrasing here is a bit confusing, and can be read as
>     contradicting the
>     sentence it follows. I believe what you mean to say can be
>     conveyed with
>     something more like:
>
>         The ordering of values received from proxies relative to values
>         received from other proxies is not significant.
>
>     ---------------------------------------------------------------------------
>
>     §2.6:
>
>      >  1.  The URI included in the challenge has the following BNF:
>
>     Please cite RFC 5234.
>
>     ---------------------------------------------------------------------------
>
>     §3:
>
>      >  This opens the system to the potential of a downgrade attack
>     by man-
>      >  in-the-middle.
>
>     The phrasing here is a bit awkward. I might suggest rephrasing as:
>     "...a downgrade attack by an on-path attacker."
>
>

---

From: Rifaat Shekh-Yusef <[email-masked]>
Date: Tue, 17 Sep 2019 04:50:03 -0400

Thanks Adam,

I have just submitted a new version that addresses your comments.
Please, take a look and let me know if you have any further comments.

Regards,
 Rifaat

On Tue, Sep 17, 2019 at 12:54 AM Adam Roach <[email-masked]> wrote:

>
> The last call on this document has concluded, and I see no comments other
> than my own AD review. As soon as a new version of the document is in the
> repository, I'll get it scheduled on the next telechat. Thanks!
>
> /a
>
> On Thu, Aug 29, 2019 at 6:11 PM Adam Roach <[email-masked]> wrote:
>
>> IETF last call on it shortly. I did find some minor issues, described
>> below,
>>  >  The
>>  >  ordering of the header field values from the various proxies is not
>>  >  significant.
>>
>> The phrasing here is a bit confusing, and can be read as contradicting the
>> sentence it follows. I believe what you mean to say can be conveyed with
>> something more like:
>>
>>  >  1.  The URI included in the challenge has the following BNF:
>>
>> Please cite RFC 5234.
>>
>>
>>  >  This opens the system to the potential of a downgrade attack by man-
>>  >  in-the-middle.
>>