Subject: [sipcore] draft-ietf-sipcore-sec-flows-01: document scope and intent

From: Brian Hibbard <[email-masked]>
Date: Tue, 24 Nov 2009 15:25:46 -0600

A new version of the SIP Sec Flows draft is now available at http://www.ietf.org/internet-drafts/draft-ietf-sipcore-sec-flows-01.txt 
.

The feedback on the draft so far raises some interesting points about  
the scope of the Sec Flows draft.  There are some basic issues that  
need to be resolved for the draft to proceed.  Responses to some of  
these issues may indicate the need for additional document(s) or a  
change in scope of the draft.

== Informative vs Normative ==

The draft states in the first line of the introduction that it is not  
normative for SIP.  That raises the question as to whether this should  
be on the standards track.  Should this be informational or BCP?

== Tutorial or Reference ==

Is the draft intended to be a hitchhikers' guide to security for SIP  
implementers?

Does the draft intend to be a training tool to educate implementers in  
PKI?  How far do we want to go in teaching developers how to generate  
and manage certificates?  For example, are we trying to teach how to  
administer a Certificate Authority and want to deal with how certs are  
generated in the real world?  Or are we only concerned with the  
cryptography of the messages, and we are only providing certificates and

Are we only trying to provide specific reference examples for helping  
verify implementations?

If so, should we be providing test vectors instead?  Is the document  
intending to recommend how things should be done, how they might be  
done, or how they must be done?

== Document Title ==

Depending on the resolution of the above, we may need to consider  
changing the document's title.