Subject: Re: [AVT] IESG review of draft-ietf-avt-srtp.08 - first comments

From: "Steven M. Bellovin" <[email-masked]>
Date: Fri, 13 Jun 2003 22:59:31 -0400

In message <[email-masked]>, =?ISO-8859-1?Q?Mats_N=E4slund?= wr
ites:
>
>Dear all,
>
>Since I haven't seen any other reply, I will give a quick
>response to Steve's concern (forwarded by Allison below).
>See inline.
>
>
>Allison Mankin wrote:
> > Mark and other SRTP authors,
> >
> > The IESG is considering SRTP at the telechat tomorrow.  The review will
> > continue over till the Jun 26th meeting, so some comments will not 
>come in
> > yet, but here is a Discuss comment from Steve Bellovin that it would 
>be good
> > to respond to (don't revise the draft yet, though).
> >
> > Allison
> >
> > ------- Forwarded Message
> >
> >
> >>	Please return the full line with your position.
> >>
> >>                   Yes    No-Objection  Discuss *  Abstain
> >>
> >>
> >>Steve Bellovin      [   ]     [   ]       [ x ]      [   ]
> >
> >
> >
> > SSRC should be expanded in the text the first time it's used.
>
>OK.
>
> >
> > The IV definition in 4.1.1 has me a bit nervous.  Right now, it's
> > (k_s << 16) ^ (ssrc << 64) ^ (i << 16), where k_s is the session key,
>
>Note: k_s is the "session salt", not the "session key".
>I am not sure if this is a typo or a missinterpretation of the spec.
>In the latter case (you've misstaken the salt for the key), I can
>certainly see your concerns...

You're right -- I misread the spec.  I withdraw my DISCUSS; the 
SSRC change is a trivial RFC editor's note.

		--Steve Bellovin, http://www.research.att.com/~smb (me)
		http://www.wilyhacker.com (2nd edition of "Firewalls" book)

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt