Subject: [MMUSIC] Secdir last call review of draft-ietf-mmusic-dtls-sdp-22

From: Rich Salz <[email-masked]>
Date: Thu, 06 Apr 2017 10:00:00 -0700

Reviewer: Rich Salz
Review result: Has Nits

The term "ufrag" should be explained, or at least have a reference on
its first use.  It seems important :)

I think the "fingerprint" reference should be moved up to the bullet
list in section 4, from the bullet list in 5.1

Sec 4 uses the term "cryptographic random function" which is not a
common security term.  (See
https://en.wikipedia.org/wiki/Cryptographically_secure_pseudorandom_number_generator)
 I would just say "strong random function"; it's the number of random
bits that counts.  Or use CSPRNG as the term.

In Sec 9, it seems like quoting all the old text is way too verbose. 
I would just say "replace with the following NEW TEXT"
If it's not replacing an entire section, then say "the nnn paragraphs
starting with xxxxx" or similar construct.

---

From: Christer Holmberg <[email-masked]>
Date: Thu, 6 Apr 2017 18:37:32 +0000

Hi Rich,

Thanks for your review!

Note that, based on discussions in Chicago, the draft will be extended to also cover TLS associations. So, it may end up on your table again at some point :)

Never the less, I will reply to your comments, because some of them are not related to the change.

>Reviewer: Rich Salz
>Review result: Has Nits
>
>The term "ufrag" should be explained, or at least have a reference on its first use.  It seems important :)

I will add a reference to draft-5245bis.

>I think the "fingerprint" reference should be moved up to the bullet list in section 4, from the bullet list in 5.1

I am not sure. The bullet list in section 4 talks about the fingerprint in general, while the bullet list in 5.1 talks about the fingerprint attribute.

>Sec 4 uses the term "cryptographic random function" which is not a common security term.  (See
>I would just say "strong random function"; it's the number of random bits that counts.  Or use CSPRNG as the term.

I will use "strong random function".

>If it's not replacing an entire section, then say "the nnn paragraphs starting with xxxxx" or similar construct.

This comes up everything a section is updated. Some people only want to updated parts, while others want the whole updated section - no matter how much or little has been updated. So, I'd like to keep it as it is.

Note, however, that based on the gen-art review I will place the updates of each individual section in a separate sub section of the draft.

Regards,

Christer

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 6 Apr 2017 18:38:52 +0000

> Note that, based on discussions in Chicago, the draft will be extended to also
> cover TLS associations. So, it may end up on your table again at some point :)

:)
 
> I am not sure. The bullet list in section 4 talks about the fingerprint in general,
> while the bullet list in 5.1 talks about the fingerprint attribute.

Ah, okay.  Perhaps some wording can  clear that up?  Or maybe "fingerprint attribute" and, what, "association fingerprint" ?

Thanks for reading.