Subject: [secdir] SecDir Review ofdraft-ietf-mmusic-image-attributes

From: Stephen Farrell <[email-masked]>
Date: Thu, 13 Jan 2011 11:52:34 +0000

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  Document editors and WG chairs should treat these comments just
like any other last call comments.

This draft defines a way to ask a sender to use different image
attributes using SDP.

The security considerations says that this doesn't change anything,
but I don't quite agree. A requestor could (accidentally or on
purpose) as for some very large image size or for some kind
of transformation that puts a lot of load on a transcoder, and
that could be part of some DoS attack. (I've actually seen this
bug triggered accidentally in a real system that did more or
less this.)

I'd suggest adding a paragraph to the security considerations
saying that implementations should be wary of this and could
include some sanity checking of inputs or could try to detect
cases where lots of resources are being used and then handle that
somehow. I don't know how that'd be best done, nor whether any
of that should use 2119 type language, but I assume the authors
can figure that out.

Stephen.

---

From: 정경훈 <[email-masked]>
Date: Thu, 13 Jan 2011 13:33:39 +0000 (GMT)

Dear Mr. Stephen Farrell and IETF experts:

Thank you for your kind comments.

When we start this work in 2007 (finished in 3GPP and early implementations soon),

our key objective was to maximize the perceived quality of 4G mobile video telephony

at the low but most expensive bit-rate, perhaps second only to satellite in terms of cost.

Considering the strong security of IMS, over which the 4G handset using this attribute will be

deployed, we did not pay enough attention to areas you kindly mentioned. Apparantly, if the

image sizes accompanying "imageattr" are corrupted during negotiation, session setup can be

delayed or even dropped. We will reflect your advices into the draft soon.

Thank you again and many comments or corrections will be greatly welcomed.

Kyunghun Jung

Samsung Electronics Co., Ltd.

------- Original Message -------

Sender : Stephen Farrell<[email-masked]>

Date : 2011-01-13 20:52 (GMT+09:00)

Title : [secdir] SecDir Review ofdraft-ietf-mmusic-image-attributes

Stephen.