Subject: Re: [MEDIACTRL] Framework: cfw-id

From: "Chris Boulton" <[email-masked]>
Date: Wed, 14 Jan 2009 14:11:57 -0000

The text for Framework says cfw-id "MUST contain an appropriately  
random value of at least 64 bits of randomness that will not clash  
with other offer/answer exchanges that will take place and is globally  
unique over space and time.["

Why must this be random? The only reason I can think of is if we are  
worried about attackers guessing the cfw-id. Is this the case? If so,  
we need to say so. If not, we should say, "This attribute MUST be  
globally unique over space and time. The algorithm for constructing it  
is ..." It is a lot easier to make the attribute globally unique than  
it is to make it random and hope it is globally unique. I have seen a  
lot of documents get kicked back from IESG with language like what we  
have today, so we have to fix it one way or the other. If we are  
worried about attackers AND uniqueness, we can construct it AND have a  
random token.

[Chris Boulton] Agreed.  No problem.  Its probably just guidance that I
took from somewhere else (another specification).

Chris.

_______________________________________________
MEDIACTRL mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mediactrl
Supplemental Web Site:
http://www.standardstrack.com/ietf/mediactrl