Subject: Re: [Speechsc] mrcpv2-01: Security Considerations and URI's

From: Sarvi Shanmugham <[email-masked]>
Date: Tue, 03 Feb 2004 23:37:11 -0800

Eric Burger wrote:

>The document needs a security considerations section.
>
agreed.

>
>The protocol allows for fetching by reference.  We need to point out the potential for attack amplification (one MRCPv2 request generating lots of fetches) -- both on the server itself and as a platform for a DDoS attack.
>
ok.

>
>How do we want to handle URI's.  For interoperability, we should mandate certain schemas.  I would vote for http being a MUST implement and https being a SHOULD.  Is the requirement for http too strong?
>
I think MUST http and SHOULD https sounds reasonable.

>
>What happens if the server does not support the URI scheme?  E.g., a file://mumble/foo or ftp://mumble/foo?  What if the scheme doesn't make sense, e.g., tel:3211234567?
>
The command would fail, and the response would carry the Failed-URI 
header and cause.

>
>
>URI's appear in the Synthesizer Speech Data fetch list (S 7.5), Waveform URL (S 8.4)
>  
>
Same as above.

Sarvi

>
>_______________________________________________
>Speechsc mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/speechsc
>
>  
>

_______________________________________________
Speechsc mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speechsc

---

From: "Eric Burger" <[email-masked]>
Date: Mon, 9 Feb 2004 16:27:44 -0500

I just got done with the first pass of an IESG review of a SIPPING document.  Given that sensitive data may be passed between the asr/tts/si/sv server, https is a MUST to implement (but not to use).

Likewise, the session establishment protocol MUST support Digest (sip:) and SHOULD support sips:.
[That is a straw man.  MUST we support sips:?  Should Digest be a SHOULD?]

The Security Considerations section must describe when to protect user data, e.g. when pass codes are flying about, personal profiles (e.g., SV) are flying about, etc.  That will make IESG review a much happier affair :-)

> -----Original Message-----
> From: Sarvi Shanmugham [mailto:[email-masked]]
> Sent: Wednesday, February 04, 2004 2:37 AM
> To: Eric Burger
> Cc: IETF SPEECHSC (E-mail)
> Subject: Re: [Speechsc] mrcpv2-01: Security Considerations and URI's
> 
> 
> 
> 
> Eric Burger wrote:
> 
> >The protocol allows for fetching by reference.  We need to 
> point out the potential for attack amplification (one MRCPv2 
> request generating lots of fetches) -- both on the server 
> itself and as a platform for a DDoS attack.
> >
> ok.
> 
> >
> >How do we want to handle URI's.  For interoperability, we 
> should mandate certain schemas.  I would vote for http being 
> a MUST implement and https being a SHOULD.  Is the 
> requirement for http too strong?
> >
> >What happens if the server does not support the URI scheme?  
> E.g., a file://mumble/foo or ftp://mumble/foo?  What if the 
> scheme doesn't make sense, e.g., tel:3211234567?
> >