Subject: [secdir] SecDir review of draft-ietf-avt-rtcp-port-for-ssm-03

From: Donald Eastlake <[email-masked]>
Date: Tue, 14 Dec 2010 22:46:44 -0500

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  Document editors and WG chairs should treat these comments just
like any other last call comments.

This draft specifies the addition of a new SDP attribute. This
attribute does not appear to present any new type of security
vulnerability.

I believe the Security Considerations section needs a small addition
to avoid being too vague. It currently just says "Therefore, as usual
adequate security measures are RECOMMENDED ..." without giving any
hint as to what those measures are or where to find any. Admittedly,
this draft is an update to RFC 5760 and a reasonable non-exclusive
list of such measures occurs in that RFC. Nevertheless, I would be
much more comfortable if the Security Considerations section wording
was augmented so it said "Therefore, adequate security measures, such
as those listed in the Security Considerations section of [RFC5760],
are RECOMMENDED...".

Trivia:

The following sentence:
   "The formal description of the 'multicast-rtcp' attribute is defined
   by the following ABNF [RFC5234] syntax:"
somehow reads as sort of redundantly redundant. Maybe: "The following
ABNF [RFC5234] syntax formally describes the 'multicast-rtcp'
attribute:"

Thanks,
Donald
=============================
 Donald E. Eastlake 3rd   +1-508-333-2270 (cell)
 [email-masked]

---

From: Donald Eastlake <[email-masked]>
Date: Wed, 15 Dec 2010 01:14:49 -0500

Thanks, that wording looks good.
Donald

On Tue, Dec 14, 2010 at 11:52 PM, Ali C. Begen (abegen)
<[email-masked]> wrote:
> Hi Donald,
>
> Thanks for the review.
>
>> -----Original Message-----
>> From: Donald Eastlake [mailto:[email-masked]]
>> Sent: Tuesday, December 14, 2010 10:47 PM
>> To: [email-masked]; [email-masked]; Ali C. Begen (abegen); Keith Drage; Roni Even
>> Subject: SecDir review of draft-ietf-avt-rtcp-port-for-ssm-03
>>
> Based on other reviews and discussing with the AD, we went one step further and the sentence above is replaced with:
>
> "In order to avoid attacks of this sort, the SDP description needs to be integrity protected and provided with source authentication. This can, for example, be achieved on an end-to-end basis using S/MIME RFC5652 when SDP is used in a signaling packet using MIME types (application/sdp). Alternatively, HTTPS RFC2818 or the authentication method in the Session Announcement Protocol (SAP) RFC2974 could be used as well."
>
>> Trivia:
>>
>> The following sentence:
> Sounds good.
> Cheers, acbegen.

---

From: "Ali C. Begen (abegen)" <[email-masked]>
Date: Tue, 14 Dec 2010 20:52:33 -0800

Hi Donald,

Thanks for the review.

 

Sounds good.

Cheers, acbegen.