Subject: [bfcpbis] Kathleen Moriarty's No Objection on draft-ietf-bfcpbis-sdp-ws-uri-08: (with COMMENT)

From: "Kathleen Moriarty" <[email-masked]>
Date: Wed, 18 Jan 2017 12:46:26 -0800

Kathleen Moriarty has entered the following ballot position for
draft-ietf-bfcpbis-sdp-ws-uri-08: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-bfcpbis-sdp-ws-uri/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I may have missed it, but don't see a clear reason (would expect to see
it in the security considerations section) as to why TLS isn't a MUST. 
RECOMMENDED is good, but having a reason to justify this would be
helpful.  It seems like it is for legacy support of HTTP applications,
but spelling that out might be helpful.

---

From: "Ram Mohan R (rmohanr)" <[email-masked]>
Date: Mon, 30 Jan 2017 04:27:25 +0000

Hi Kathleen,

Please see inline <Ram>

-----Original Message-----
From: bfcpbis <[email-masked]> on behalf of Kathleen Moriarty <[email-masked]>
Date: Thursday, 19 January 2017 at 2:16 AM
To: The IESG <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "Charles Eckel (eckelcu)" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: [bfcpbis] Kathleen Moriarty's No Objection on draft-ietf-bfcpbis-sdp-ws-uri-08: (with COMMENT)

    

<Ram> That’s right. This specification allows the new SDP attribute to carry  secure WebSocket URI (wss-URI) and webSocket URI (ws-URI) as defined in RFC 6455.
I would expect application specifications that refers to this draft when using WebSocket as transport protocol will tighten this by mandating secureWebSocket or webSocket as transport protocol depending on the application requirements. For example, with BFCP over WS draft we are mandating use of secureWebSocket when BFCP signalling is secure.
That said, I can re-word the text here as below (inline with what Section 10.6 of RFC6455 has). Does this sound better ?

EXISTING:
It is also RECOMMENDED that the application signaling traffic being transported 
      over a WebSocket communication session be protected by using a secure WebSocket
      connection (using TLS [RFC5246] over TCP).

NEW:
As described in Section 10 of [RFC6455],  application signalling traffic being transported over WebSocket MUST support secure WebSocket and SHOULD employ it when communicating with their peers.
    
Regards,
Ram    
    _______________________________________________
    bfcpbis mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/bfcpbis