Subject: [Simple] I-D Action:draft-ietf-simple-msrp-acm-05.txt

From: [email-masked]
Date: Thu, 18 Feb 2010 06:00:01 -0800 (PST)

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the SIP for Instant Messaging and Presence Leveraging Extensions Working Group of the IETF.

	Title           : An Alternative Connection Model for the Message Session Relay Protocol (MSRP)
	Author(s)       : C. Holmberg, S. Blau
	Filename        : draft-ietf-simple-msrp-acm-05.txt
	Pages           : 9
	Date            : 2010-02-18

This document defines an alternative connection model for Message
Session Relay Protocol (MSRP) User Agents (UAs), which uses the
connection-oriended media (COMEDIA) mechanism in order to create the
MSRP transport connection.  The model allows MSRP UAs behind Network
Address Translators (NATs) to negotiate which UA will initiate the
establishment of the TCP connection, in order for MSRP messages to
traverse the NAT.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-simple-msrp-acm-05.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Ben Campbell <[email-masked]>
Date: Thu, 25 Feb 2010 16:04:21 -0600

Do you mean to have all of the requirements in section 4.3 scoped to "UAs conformant to this specification"? That's not clear to me for the requirements in the 2nd and 3rd paragraph. I don't have issues having these requirements for ACM clients, but I'm not sure this draft should be making normative statements about how MSRP UAs use TLS in _general_.

Section 4.3 still seems to require all MSRP UAs that use TLS to have a certificate of some form, either a self-signed or a PKI certified one. It also implies a MUST level requirement to do mutual authentication, even though the prior paragraph says they SHOULD do mutual authentication. Should the paragraph have started with something to the effect of "When using mutual authentication..."?

On Feb 18, 2010, at 8:00 AM, [email-masked] wrote:

> <Mail Attachment>_______________________________________________
> Simple mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/simple

---

From: Ben Campbell <[email-masked]>
Date: Thu, 25 Feb 2010 16:43:39 -0600

Also, I meant to say "Otherwise, this version addresses my WGLC comments."

On Feb 25, 2010, at 4:04 PM, Ben Campbell wrote:

> _______________________________________________
> Simple mailing list
> [email-masked]

---

From: Christer Holmberg <[email-masked]>
Date: Sun, 28 Feb 2010 17:40:26 +0100

Hi Ben,

>Do you mean to have all of the requirements in section 4.3 scoped to "UAs conformant to this specification"? 
>That's not clear to me for the requirements in the 2nd and 3rd paragraph. I don't have issues having these 
>requirements for ACM clients, but I'm not sure this draft should be making normative statements about how 
>MSRP UAs use TLS in _general_.
>
>Section 4.3 still seems to require all MSRP UAs that use TLS to have a certificate of some form, either a 
>self-signed or a PKI certified one. It also implies a MUST level requirement to do mutual authentication, even 
>though the prior paragraph says they SHOULD do mutual authentication. Should the paragraph have started 
>with something to the effect of "When using mutual authentication..."?

The 1st paragraph is ACM specific, so I think having normative text is ok. I can clarify that muthual authentication only applies when the UAs have certificates.

"If an MSRP UA conformant to this document uses TLS, it MUST use the
TLS mechanisms defined in [RFC4975] and [RFC4976].  If the MSRP UAs 
have TLS certificates, when establishing a TLS connection between peer MSRP UAs, 
mutual authentication of the TLS connection SHOULD be done.  From TLS 
authentication point of view it is thus irrelevant whether an endpoint takes the 
active or passive role."

The 2nd paragraph is not ACM specific - it is supposed to be a clarfication of the procedures in RFC 4975. So, I do agree that we probably should not use "MUST" etc in the text. Instead we could say something like:

"In accordance with [RFC4975], if an MSRP UA has a TLS certificate, it always sends the certificate to the other endpoint during the TLS establishment. If an MSRP UA uses a self-signed TLS certificate to authenticate itself to MSRP peers it also includes its certificate fingerprint in the SDP."

Also here I added "if an MSRP UA has a TLS certificate", to indicate that it is not mandated by 4975.

The 3rd paragraph does not contain normative text in my opinion. It simply says that MSRP relays won't receive the SDP payloads containing the fingerprint attributes.

Regards,

Christer