Subject: [payload] Kathleen Moriarty's No Objection on draft-ietf-payload-vp8-17: (with COMMENT)

From: "Kathleen Moriarty" <[email-masked]>
Date: Wed, 16 Sep 2015 19:24:33 -0700

Kathleen Moriarty has entered the following ballot position for
draft-ietf-payload-vp8-17: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-payload-vp8/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Why is this a SHOULD:
Applications SHOULD use one or more appropriate strong security
mechanisms.

Wouldn't it be more helpful to point out why you would use specific
security mechanisms for security considerations?

---

From: "Ben Campbell" <[email-masked]>
Date: Wed, 16 Sep 2015 23:04:45 -0500

> security mechanisms for security considerations?

Hi Kathleen,

That's part of the boilerplate for payload drafts. The idea is that the 
security requirements are specific to the application that uses RTP, not 
RTP itself or the related payload format. For example, WebRTC requires 
DTLS-SRTP. There's an open discussion on what should be required for 
point-to-point RTP sessions signaled via SIP (which I need to push 
forward.)

This is discussed further in RFCs 7201 and 7202.

Thanks!

Ben.

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 17 Sep 2015 06:46:07 -0400

Sent from my iPhone

> On Sep 17, 2015, at 12:04 AM, Ben Campbell <[email-masked]> wrote:
> 
> That's part of the boilerplate for payload drafts. The idea is that the security requirements are specific to the application that uses RTP, not RTP itself or the related payload format. For example, WebRTC requires DTLS-SRTP. There's an open discussion on what should be required for point-to-point RTP sessions signaled via SIP (which I need to push forward.)
> 

Thanks, Ben!

Do you recall which draft we changed that in or was it unrelated, just an incredibly similar sentence?

Thanks,
Kathleen

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 17 Sep 2015 09:38:22 -0400

Hi Ben,

I was able to dig up the document we had this discussion on and the
boilerplate appropriately reflects the outcome of the discussion from
rfc7587.  I knew I remembered the wording when I saw it, and it is
what was agreed upon.

Thanks,
Kathleen

-- 

Best regards,
Kathleen