Subject: [secdir] sec-dir review of draft-ietf-payload-rtp-opus-08

From: Derek Atkins <[email-masked]>
Date: Tue, 17 Feb 2015 14:54:26 -0500

Hi,

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written with the intent of improving
security requirements and considerations in IETF drafts.  Comments
not addressed in last call may be included in AD reviews during the
IESG review.  Document editors and WG chairs should treat these
comments just like any other last call comments.

Summary:

Ready to publish with a question: I question why the use of SRTP is a
MAY and not a SHOULD (as detailed in the Security Considerations
section).  Considering PERPASS I believe this should be a SHOULD;
someone should have a very good reason why they are NOT using SRTP.

Details:

   This document defines the Real-time Transport Protocol (RTP) payload
   format for packetization of Opus encoded speech and audio data
   necessary to integrate the codec in the most compatible way.
   Further, it describes media type registrations for the RTP payload
   format.

I have no other comments on this document.

-derek

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: Roni Even <[email-masked]>
Date: Thu, 19 Feb 2015 05:26:33 +0000

Hi,
The reason for the may is discussed in RFC7201 and RFC 7202, it can be a SHOULD and these  RFCs exaplain when it is not required to use SRTP.
Maybe add a reference to these RFCs in the security section when saying talking about good reasons for not using SRTP

Roni Even

________________________________________
From: Jean-Marc Valin [[email-masked]] on behalf of Jean-Marc Valin [[email-masked]]
Sent: Tuesday, February 17, 2015 10:23 PM
To: Derek Atkins; [email-masked]; [email-masked]
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: sec-dir review of draft-ietf-payload-rtp-opus-08

Hi Derek,

There was no particular reason for the MAY, the text was merely copied
from other RTP payload RFC. I totally agree with making it a SHOULD.

Thanks,

        Jean-Marc

---

From: Derek Atkins <[email-masked]>
Date: Thu, 19 Feb 2015 12:07:51 -0500

Roni,

I'm not an RTP guy.  To me "SRTP" is a general class of "Secure RTP"
protocols.  So let's work on that as my starting point:  implementations
SHOULD protect their RTP stream.

Based on that, how about a re-wording here?  Instead of just saying "MAY
use SRTP", how about something like "SHOULD use one of the possible RTP
Security methods (See RFC7201, RFC7202)"?  (Obviously this can be worded
better).

-derek

Roni Even <[email-masked]> writes:

> Hi,
> The reason for the may is discussed in RFC7201 and RFC 7202, it can be
> a SHOULD and these RFCs exaplain when it is not required to use SRTP.
> Maybe add a reference to these RFCs in the security section when
> saying talking about good reasons for not using SRTP
>
> Roni Even
>
> _______________________________________________
> secdir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview
>
>