Subject: [AVTCORE] draft-ietf-avtcore-rtp-security-options-06 review

From: "Peck, Michael A" <[email-masked]>
Date: Wed, 2 Oct 2013 15:22:35 +0000

Hi,

I reviewed draft-ietf-avtcore-rtp-security-options-06.  It looks good, I have a few minor comments.

Section 3.1:
I suggest removing the phrase "…and NSA Suite B included cryptographic transforms." from the "AES-192 and AES-256:" paragraph.
The RFC6188 crypto suites are technically not Suite B compliant because they use HMAC-SHA1 for authentication, and SHA-1 is not part of Suite B.

Section 3.3:
Another downside of IPsec perhaps worth pointing out is that if it's relied upon instead of a higher layer mechanism, information about the authenticated identities of the endpoints, or an indication of whether encryption is even in place at all, are generally not available at the application layer to present through the user interface.

Editorial comments:

Introduction:
"so it worth" -> "so it is worth"

3.6:
"such the fact" -> "such as the fact"

---

From: Magnus Westerlund <[email-masked]>
Date: Mon, 7 Oct 2013 10:59:34 +0200

Hi Michael,

Thanks for the review.

On 2013-10-02 17:22, Peck, Michael A wrote:
> I suggest removing the phrase "…and NSA Suite B included cryptographic
> transforms." from the "AES-192 and AES-256:" paragraph.
> The RFC6188 crypto suites are technically not Suite B compliant because
> they use HMAC-SHA1 for authentication, and SHA-1 is not part of Suite B.

Ok, done.

> 
> Section 3.3:
> Another downside of IPsec perhaps worth pointing out is that if it's
> relied upon instead of a higher layer mechanism, information about the
> authenticated identities of the endpoints, or an indication of whether
> encryption is even in place at all, are generally not available at the
> application layer to present through the user interface.

I have added a sentence to the end of this paragraph:

The main concern with using IPsec to protect RTP traffic is that in most
cases using a VPN approach that terminates the security association at
some node prior to the RTP end-point leaves the traffic vulnerable to
attack between the VPN termination node and the end-point. Thus usage of
IPsec requires careful thought and design of its usage so that it meets
the security goals. A important question is how one ensures the IPsec
terminating peer and the ultimate destination are the same. Applications
can have issues using existing APIs with determining if IPsec is being
used or not, and when used who the authenticated peer entity is.

Below has been edited in.
> "such the fact" -> "such as the fact"

Cheers

Magnus Westerlund

----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVM
----------------------------------------------------------------------
Ericsson AB                | Phone  +46 10 7148287
Färögatan 6                | Mobile +46 73 0949079
SE-164 80 Stockholm, Sweden| mailto: [email-masked]
----------------------------------------------------------------------