Subject: [AVTCORE] Roman Danyliw's No Objection on draft-ietf-avtcore-multi-party-rtt-mix-18: (with COMMENT)

From: Roman Danyliw via Datatracker <[email-masked]>
Date: Tue, 18 May 2021 19:27:29 -0700

Roman Danyliw has entered the following ballot position for
draft-ietf-avtcore-multi-party-rtt-mix-18: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-avtcore-multi-party-rtt-mix/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you to Rich Salz for the SECDIR review.

** Section 11.  Per “Participants with malicious intentions may appear ...”,
this text seems to be describing an attacker that is party to the call.  If the
mitigations suggested in the next sentence (i.e., secure signaling ... and
authentication) aren’t present, this style of attack may also be possible by an
on-path attacker as might be simple eavesdropping or injection of arbitrary
content.

** Section 11. Would the caution of the mixer not revealing that a user is
hearing or speech impaired noted in Section 8 of RFC5194 apply here too?

---

From: Gunnar Hellström <[email-masked]>
Date: Tue, 25 May 2021 22:42:20 +0200

Roman,

Thank you for the review,

please see answers inline,

> https://datatracker.ietf.org/doc/draft-ietf-avtcore-multi-party-rtt-mix/
[GH] I added this sentence in section 11: "Care should be taken that if 
use of the mixer is allowed for users both with and without security 
procedures, opens for possible attacks by both unauthenticated call 
participants and even eavesdropping and manipulating of content 
non-participants."
> hearing or speech impaired noted in Section 8 of RFC5194 apply here too?
[GH] Yes. How about inserting this sentence in section 8: " The services 
available through the RTT mixer may have special interest for deaf and 
hard-of-hearing persons. Some users may want to refrain from revealing 
such characteristics broadly in conferences. The design of the 
conference systems where the mixer is included MAY need to be made with 
confidentiality of such characteristics in mind."

Thanks,

Gunnar

-- 
Gunnar Hellström
GHAccess
[email-masked]