Subject: [avtext] Stephen Farrell's No Objection on draft-ietf-avtext-sdes-hdr-ext-07: (with COMMENT)

From: "Stephen Farrell" <[email-masked]>
Date: Fri, 10 Jun 2016 03:27:34 -0700

Stephen Farrell has entered the following ballot position for
draft-ietf-avtext-sdes-hdr-ext-07: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-avtext-sdes-hdr-ext/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for handling my DISCUSS point.

--- OLD COMMENTS below, I didn't check 'em

- So this one confused me for a bit but I was thinking
about RFC4568 - shame about that acronym collision;-)
It'd have helped this reader to say that this is not
about sending keys in header fields:-) But I'm probably
not the intended reader, so it's fine that you didn't.

- I wonder if confidentiality protection of these header
fields is likely? Is that more or less likely to be
deployed than some security for RTCP? If there's a
significant difference then I think that ought be called
out. Just pointing at rfc6904 doesn't seem entirely
sufficient to me if nobody ever does it. 

- Has someone done an analysis of the privacy
implications of moving values from one context (RTCP) to
another (RTP) over the range of likely deployments? Note:
I'm not asserting that there is a significant privacy
exposure here, I don't know if there is or not. So I'm
just asking if folks have thought about that and e.g.
whether or not some data exposed in this header field
could allow easier re-identification or correlation or
some similar and possibly subtle privacy issue.