Subject: Re: [secdir] review of draft-ietf-mmusic-connectivity-precon-06

From: Stephen Kent <[email-masked]>
Date: Wed, 28 Oct 2009 09:40:19 -0400

I re-reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  In the re-review I examined only on the text that the authors 
said was changed in response to my comments.

In my initial review I said that the text about using suitable 
authentication and integrity mechanisms in this context was too vague 
to be useful and hat it should cite specific recommendations (via 
RFCs).

The authors have revised the relevant text and it is better. The 
revised text elicited a comment from Sam Hartman that SIP Identity 
(RFC 4474) should be cited. I agree with this suggestion, but believe 
that the current cite for using S/MIME with SDP [RFC 3261] also 
should be retained, until such time as the RAI area decides to move 
it to historical.

I think the expanded discussion of DoS concerns is better as well, 
even though no explicit threat model has been provided.

I did note a grammatical error:

"This attack would result in a poor user's experience ..."  ->

"This attack would result in a poor user experience ..."

Steve

---

From: Sandra Murphy <[email-masked]>
Date: Thu, 29 Oct 2009 11:44:09 -0400 (Eastern Daylight Time)

On Wed, 28 Oct 2009, Stephen Kent wrote:

> I re-reviewed this document as part of the security directorate's ongoing 
> effort to review all IETF documents being processed by the IESG.  In the 
> re-review I examined only on the text that the authors said was changed in 
> response to my comments.
>
> In my initial review I said that the text about using suitable authentication 
> and integrity mechanisms in this context was too vague to be useful and hat 
> it should cite specific recommendations (via RFCs).
>
> The authors have revised the relevant text and it is better. The revised text 
> elicited a comment from Sam Hartman that SIP Identity (RFC 4474) should be 
> cited. I agree with this suggestion, but believe that the current cite for 
> using S/MIME with SDP [RFC 3261] also should be retained, until such time as 
> the RAI area decides to move it to historical.
>
> I think the expanded discussion of DoS concerns is better as well, even 
> though no explicit threat model has been provided.
>

Chuckle.

One does indeed hope that this is a grammatical error.  Finding a source 
to authenticate the user's poverty could be daunting, not to mention a 
privacy issue.

--Sandy