Subject: Re: [straw] I-D Action: draft-ietf-straw-b2bua-dtls-srtp-08.txt

From: "Ram Mohan R (rmohanr)" <[email-masked]>
Date: Tue, 17 Nov 2015 09:10:44 +0000

Hi Ben,

Thanks for your feedback. Please see diffs attached. Also see inline

-----Original Message-----
From: Ben Campbell <[email-masked]>
Date: Tuesday, 27 October 2015 at 8:19 AM
To: "[email-masked]" <[email-masked]>,
"[email-masked]"
<[email-masked]>
Subject: Re: [straw] I-D Action: draft-ietf-straw-b2bua-dtls-srtp-08.txt

>Hi,
>
>This version addresses many of my comments. I'm going to go ahead and
>send start the IETF last call process.  I do have a few new or remaining
>comments, but these can be handled with along with other IETF last call
>comments.
>
>Thanks!
>
>Ben.
>
>- 1.2, last paragraph:
>
>The first sentence still contains a MUST that I thought was going to go
>away. Ram proposed the following, that did not seem to make it into the
>draft:
>
>"The following sections describe the behavior B2BUAs can follow to avoid
>breaking end-to-end DTLS-SRTP sessions. B2BUAs terminating DTLS-SRTP
>session are outside the scope of this document."

Missed to add. Now added this statement.

>
>I like  non-normative explanation of why you normally can't terminate
>DTLS-SRTP. But I note several other places where the draft still says
>that a b2bua MUST NOT terminate dtls-srtp. I don't think the normative
>MUST is necessary, or appropriate, as it basically tries to put
>normative requirements on b2buas that do not implement this draft.

I have removed the other normative references as well. Please have a look
at the diff and let me know if its ok.

>
>- 3.1.1, 2nd paragraph under figure 1: "... advertised to Bob in the
>    SIP offer before it receives a SIP answer from Bob ... "
>
>Should SIP offer and SIP answer be SDP offer and SDP answer?

Yes, I have fixed it now.

>
>- 3.1.1, last paragraph:
>
>Section 5 of RFC4474 and 4474bis are not the same. I _think_ section 5
>is correct for 4474, but the section number seems to be the same as from
>before when the reference was 4474bis. Please confirm the reference
>points to the right section.

Section 5 of RFC 4474 defines the procedures for how a sender (Alice) or a
authentication service in senders domain can sign and generate the
identity header and that is what we intend to refer. So I think this looks
fine.

>
>- 3.1.2: "The identity
>    integrity protection procedures described in Security Considerations
>    section MUST be used by the endpoint or the proxy server in the
>    endpoints network to detect malicious B2BUAs that attempt to
>    terminate the DTLS-SRTP session."
>
>I think this is still not quite right. This draft is not about
>endpoints, and therefore can't really introduce normative requirements
>on the endpoints (except for the case the endpoint is a B2BUA.). To do
>so would require updating 3261 and a bunch of other specs. This needs to
>be stated non-normatively, and the security considerations already do
>that.

Fixed the sentence above in 3.1.2 now.

>
>"...generate the identity..."
>
>I think this should say "generate the signature in the Identity header
>field"

 fixed this now

>
>- 3.1.2.1 and 3.1.2.2
>
>These sections seem to say the same thing with different levels of
>detail, including repetition of the "MUST NOT terminate dtls-srtp" bit.
>Can they be combined?

Prefer to keep them separate as they talk about different classes of B2BUA
(one that inspects at RTP header level and RTCP and one that also inspects
and modifies the headers).
Let me know if you think otherwise.

Regards,
Ram

>
>
>
>On 19 Oct 2015, at 11:09, [email-masked] wrote:
>
>> A New Internet-Draft is available from the on-line Internet-Drafts
>> directories.
>> This draft is a work item of the Sip Traversal Required for
>> Applications to Work Working Group of the IETF.
>>
>>      Title           : DTLS-SRTP Handling in Session Initiation
>> Protocol (SIP) Back-to-Back User Agents (B2BUAs)
>>      Authors         : Ram Mohan Ravindranath
>>                        Tirumaleswar Reddy
>>                        Gonzalo Salgueiro
>>                        Victor Pascual
>>                        Parthasarathi Ravindran
>> 	Filename        : draft-ietf-straw-b2bua-dtls-srtp-08.txt
>> 	Pages           : 12
>> 	Date            : 2015-10-19
>>
>> Abstract:
>> Session Initiation Protocol (SIP) Back-to-Back User Agents (B2BUAs)
>> often act on the media plane, rather than just on the signaling path.
>> This document describes the behavior such B2BUAs can adhere to when
>> acting on the media plane that uses an Secure Real-time Transport
>> (SRTP) security context set up with the Datagram Transport Layer
>> Security (DTLS) protocol.
>>
>>
>> The IETF datatracker status page for this draft is:
>> https://datatracker.ietf.org/doc/draft-ietf-straw-b2bua-dtls-srtp/
>>
>> There's also a htmlized version available at:
>> https://tools.ietf.org/html/draft-ietf-straw-b2bua-dtls-srtp-08
>>
>> A diff from the previous version is available at:
>> https://www.ietf.org/rfcdiff?url2=draft-ietf-straw-b2bua-dtls-srtp-08
>>
>>
>> Please note that it may take a couple of minutes from the time of
>> submission
>> until the htmlized version and diff are available at tools.ietf.org.
>>
>> Internet-Drafts are also available by anonymous FTP at:
>> ftp://ftp.ietf.org/internet-drafts/
>>
>> _______________________________________________
>> straw mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/straw