Subject: RE: Comments (RE: [speermint] requirements draft submitted)

From: "Jean-Francois Mule" <[email-masked]>
Date: Tue, 27 Jun 2006 14:12:42 -0600

Just to set the record straight on this I-D:
> > Comments on your draft
This I-D is a wg draft so it is your draft too. I consider my role as an
editor on this one.

Regarding section 2.4 requirements, Omar wrote:
> What about:
> 
> "A VSP opt-in by publishing local configuration choices is preferrable
> to a centralized 'peering registry'."
That is better, I could go with that.

> > "2.7.  Minimal additional cost on call initiation
> >
> >    Since each call setup implies execution of any proposed
algorithm,
> it
> >    should incur minimal overhead and delay, and employ caching
> wherever
> >    possible to avoid extra protocol round trips."
> >
> > We should mention that caching brings with it security problems. I
> can
> > foresee similar attacks like "SIP/URI" cache poisoning, etc
> 
> What about some generic security requirement? (independently of
> caching)
Concrete proposal welcome for discussion as usual.

> > "3.4.  Security requirements
> >
> >    All SIP messages MUST be sent over TLS [RFC3546] to provide
> >    transport-layer security as defined in RFC 3261,"
> >
> > Giving the fact that we can have security through physical
> segregation,
> > intra-federation/provider calls, etc, the "MUST" here seems too
> generic.
> >
> > I think we should say something like "in the case of public on-
> demand
> > peering SIP messages...."
> >
> 
> Agreed.

Noted.

Jean-Francois.

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint