Subject: Re: [MMUSIC] Review (by Albrecht) of draft-ietf-mmusic-udptl-dtls-02

From: Christer Holmberg <[email-masked]>
Date: Tue, 14 Jan 2014 12:46:48 +0000

Hi Albrecht,

I am sorry that it took a while to address your comments, but here we go :)

Comment inline. I try to shorten your suggested text, by keeping the essential parts, and prevent adding long notes.

-----------------------------

to 3.1<http://tools.ietf.org/html/draft-ietf-mmusic-udptl-dtls-02#section-3.1>.  Secure Channel Establishment
      Paragraph:

   In addition to the usual contents of an SDP media description ("m="

   line) specified for UDPTL over the UDP, each SDP media description

   for UDPTL over DTLS over the UDP will also contain several SDP

   attributes, as specified in [RFC4145<http://tools.ietf.org/html/rfc4145>] and [RFC4572<http://tools.ietf.org/html/rfc4572>].

proposed to be detailed by:

   In addition to the usual contents of an SDP media description ("m="

   line) specified for UDPTL over the UDP, each SDP media description

   for UDPTL over DTLS over the UDP will also contain several SDP

   attributes, which were introduced in the context of TCP and TLS (but reused here for DTLS-over-UDP), as specified in [RFC4145<http://tools.ietf.org/html/rfc4145>] (TCP) and [RFC4572<http://tools.ietf.org/html/rfc4572>] (TLS).

I suggest the following:

In addition to the usual contents of an SDP media description ("m="

      line) specified for UDPTL over UDP, each SDP media description

      for UDPTL over DTLS over UDP will also contain several SDP

      attributes (which were introduced in the context of TCP [RFC4145]

      and TLS [4572], and re-used in this document).

-----------------------------

List item:

   o  The endpoint MUST use the SDP setup attribute [RFC4145<http://tools.ietf.org/html/rfc4145>].  The

      offerer SHOULD assign the SDP setup attribute with a setup:actpass

      value, and MAY assign the SDP setup attribute with a setup:active

      value or setup:passive value.  The offerer MUST NOT assign the SDP

      setup attribute with a setup:holdconn value.  If the offerer ...

proposed to add further background information:

   o  The endpoint MUST use the SDP setup attribute [RFC4145<http://tools.ietf.org/html/rfc4145>].  The

      offerer SHOULD assign the SDP setup attribute with a setup:actpass

      value, and MAY assign the SDP setup attribute with a setup:active

      value or setup:passive value (NOTE: these rules allow to decouple the establishment direction of the DTLS session from the establishment direction of the SIP session (which may be demanded due to security considerations, NAT traversal aspects, etc.)).
The offerer MUST NOT assign the SDP

      setup attribute with a setup:holdconn value.  If the offerer ....

I suggest to simply say following:

                "In order to negotiate the TLS roles, the endpoint MUST use the SDP setup attribute [RFC4145<http://tools.ietf.org/html/rfc4145>]."

I don't think we need the other text. It's really not the main scope of the document. Other DTLS protocols also use the setup
attribute to determine the TLS roles, and we are simply doing the same thing.

-----------------------------

to 3.2<http://tools.ietf.org/html/draft-ietf-mmusic-udptl-dtls-02#section-3.2>.  Secure Channel Usage

      Paragraph:

   DTLS is used as specified in [RFC6347<http://tools.ietf.org/html/rfc6347>].  Once the DTLS handshake is

   completed, the UDPTL packets SHALL be transported in DTLS record

   layer "application_data" packets.

proposed to be detailed by:

   DTLS is used as specified in [RFC6347<http://tools.ietf.org/html/rfc6347>].  Once the DTLS handshake is

   successfully completed, the UDPTL packets SHALL be transported in DTLS record

   layer "application_data" packets.
NOTE: such a proceeding ensures that the application (i.e., T.38) does not start to transmit facsimile data already during an ongoing underlying DTLS session establishment. This aspect might be important for end-to-end scenarios with gateway equipment and a possible "UDPTL/DTLS/UDP-to-UDPTL/UDP" interworking function).

I suggest the following:

        "DTLS is used as specified in [RFC6347<http://tools.ietf.org/html/rfc6347>].  Once the DTLS handshake is

        successfully completed (in order to prevent facsimile data from being

        transmitted insecurely), the UDPTL packets SHALL be transported in DTLS

        record layer "application_data" packets."

-----------------------------

Regards,

Christer