Subject: [secdir] Review of draft-ietf-mediactrl-mixer-control-package-03

From: Shawn M Emery <[email-masked]>
Date: Sun, 04 Jan 2009 01:55:11 -0700

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the IESG. 
These comments were written primarily for the benefit of the security 
area directors. Document editors and WG chairs should treat these 
comments just like any other last call comments.

This draft describes a protocol set for managing media connection and 
conference mixers.  Auditing elements are also specified in this ID 
which allows capability and server discovery.

The security consideration section does exist and discusses potential 
attacks against the protocol if the messaging is not secure.  Another 
DoS attack not discussed in the section could be from an attacker 
impersonating an MS by sending error conditions back to the AS.

The section then continues with access control guidelines for responses, 
notifications, auditing, and rejection.  This paragraph should also make 
clear that this is only useful for secure, confidential, and integrity 
protected channels.

Do the authors believe that  RTP should be mentioned in this section and 
a reference to securing these sessions?

Editorial comment(s):

Thanks for including the definitions in this ID and the examples in the 
relevant sections (and in a dedicated section), very helpful.

s/containing a a /containing a/

4.2.1.4.3.1. Priority assignment
It seems that the default priority value of 100 is arbitrary.  Why not 
make the default 0 (zero), which would be undefined, with the highest 
priority at 1 (one), etc.?

This draft makes a normative reference to 
ietf-mediactrl-sip-control-framework, which is still an ID.

Shawn.
--
_______________________________________________
secdir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/secdir