Subject: [straw] I-D Action: draft-ietf-straw-b2bua-dtls-srtp-08.txt

From: [email-masked]
Date: Mon, 19 Oct 2015 09:09:26 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Sip Traversal Required for Applications to Work Working Group of the IETF.

        Title           : DTLS-SRTP Handling in Session Initiation Protocol (SIP) Back-to-Back User Agents (B2BUAs)
        Authors         : Ram Mohan Ravindranath
                          Tirumaleswar Reddy
                          Gonzalo Salgueiro
                          Victor Pascual
                          Parthasarathi Ravindran
	Filename        : draft-ietf-straw-b2bua-dtls-srtp-08.txt
	Pages           : 12
	Date            : 2015-10-19

Abstract:
   Session Initiation Protocol (SIP) Back-to-Back User Agents (B2BUAs)
   often act on the media plane, rather than just on the signaling path.
   This document describes the behavior such B2BUAs can adhere to when
   acting on the media plane that uses an Secure Real-time Transport
   (SRTP) security context set up with the Datagram Transport Layer
   Security (DTLS) protocol.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-straw-b2bua-dtls-srtp/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-straw-b2bua-dtls-srtp-08

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-straw-b2bua-dtls-srtp-08

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Ben Campbell" <[email-masked]>
Date: Mon, 26 Oct 2015 21:49:13 -0500

Hi,

This version addresses many of my comments. I'm going to go ahead and 
send start the IETF last call process.  I do have a few new or remaining 
comments, but these can be handled with along with other IETF last call 
comments.

Thanks!

Ben.

- 1.2, last paragraph:

The first sentence still contains a MUST that I thought was going to go 
away. Ram proposed the following, that did not seem to make it into the 
draft:

"The following sections describe the behavior B2BUAs can follow to avoid
breaking end-to-end DTLS-SRTP sessions. B2BUAs terminating DTLS-SRTP
session are outside the scope of this document."

I like  non-normative explanation of why you normally can't terminate 
DTLS-SRTP. But I note several other places where the draft still says 
that a b2bua MUST NOT terminate dtls-srtp. I don't think the normative 
MUST is necessary, or appropriate, as it basically tries to put 
normative requirements on b2buas that do not implement this draft.

- 3.1.1, 2nd paragraph under figure 1: "... advertised to Bob in the
    SIP offer before it receives a SIP answer from Bob ... "

Should SIP offer and SIP answer be SDP offer and SDP answer?

- 3.1.1, last paragraph:

Section 5 of RFC4474 and 4474bis are not the same. I _think_ section 5 
is correct for 4474, but the section number seems to be the same as from 
before when the reference was 4474bis. Please confirm the reference 
points to the right section.

- 3.1.2: "The identity
    integrity protection procedures described in Security Considerations
    section MUST be used by the endpoint or the proxy server in the
    endpoints network to detect malicious B2BUAs that attempt to
    terminate the DTLS-SRTP session."

I think this is still not quite right. This draft is not about 
endpoints, and therefore can't really introduce normative requirements 
on the endpoints (except for the case the endpoint is a B2BUA.). To do 
so would require updating 3261 and a bunch of other specs. This needs to 
be stated non-normatively, and the security considerations already do 
that.

"...generate the identity..."

I think this should say "generate the signature in the Identity header 
field"

- 3.1.2.1 and 3.1.2.2

These sections seem to say the same thing with different levels of 
detail, including repetition of the "MUST NOT terminate dtls-srtp" bit.  
Can they be combined?

On 19 Oct 2015, at 11:09, [email-masked] wrote:

> This draft is a work item of the Sip Traversal Required for 
> Applications to Work Working Group of the IETF.
>
>      Title           : DTLS-SRTP Handling in Session Initiation 
> Protocol (SIP) Back-to-Back User Agents (B2BUAs)
> _______________________________________________
> straw mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/straw