Subject: Re: [Gen-art] Gen-ART review of draft-ietf-sip-consent-framework-03

From: "Vijay K. Gurbani" <[email-masked]>
Date: Thu, 07 Feb 2008 17:18:05 -0600

Gonzalo Camarillo wrote:
> Hi Vijay,
> 
> thanks for the comments. Answers inline:

Gonzalo: Picking up the threads of this review (my sincere
apologies for not getting back to you earlier)...

For the record, all of my comments have been addressed, so I have
no additional ones.  One remaining feedback from you was:

vkg> - S5.10, third and fourth paragraphs: I think you need to make it
vkg>   more explicit that when using registrations as a mechanism to
vkg>   inject a recipient URI into a relay, the only way to do so is
vkg>   through 3rd-party registrations.  Thus, we have to ensure that
vkg>   3rd party registrations are valid through the return routability
vkg>   gyrations shown in Figure 7 (i.e., sending a MESSAGE to the
vkg>   URI in the Contact header of an incoming REGISTER, etc.)  If you
vkg>   don't make explain the reason for this 3rd-party registration step
vkg>   in some detail, the nuances on why this is done is perhaps lost
vkg>   on the reader.
gonzalo>
gonzalo> Could you propose text to make it more explicit? I have read
gonzalo> so many times this draft that it looks perfectly explicit
gonzalo> to me :o)

That is fair.  I do note that IESG just approved consent-framework-04;
so any further changes will happen during Auth48.  I will re-read
S5.10 and re-create my thinking before suggesting any text to you.
Regardless, any text suggestions will be cosmetic in nature and
not modify the underlying mechanism, so I will trust your judgment
in deciding whether or not to put these in.  I will attempt to
get the text to you as expeditiously as possible.

Thank you for your attention to my comments, and once again,
apologies for not getting back to you in earlier.

Ciao.

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
2701 Lucent Lane, Rm. 9F-546, Lisle, Illinois 60532 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
WWW:   http://www.alcatel-lucent.com/bell-labs
_______________________________________________
Gen-art mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/gen-art

---

From: Gonzalo Camarillo <[email-masked]>
Date: Fri, 08 Feb 2008 09:42:21 +0200

Hi Vijay,

perfect! I will introduce your text (send it to me when you have it 
ready) in AUTH48.

Thanks!

Gonzalo

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Sat, 09 Feb 2008 09:02:18 -0600

> perfect! I will introduce your text (send it to me when you have it 

Gonzalo: Regarding consent-framework-04 and some text in S5.10,
here is a crack at it.  This is in S5.10 of -04, towards the end
of page 23 and beginning of page 24.

OLD:
   However, this schema creates some potential attacks which relate
   to third-party registrations.

NEW:
   This is not the case in third-party registrations; i.e., the
   entity doing the registration is not the one that will
   ultimately be receiving traffic.  To mitigate unsolicited traffic
   attacks when using third party registrations, additional
   authorization steps are necessary as described below.

That's it.  Thanks for indulging me ;-)

- vijay

---

From: Gonzalo Camarillo <[email-masked]>
Date: Sun, 10 Feb 2008 22:26:33 +0200

Hi Vijay,

I agree your text is clearer. I will make a note and request this change 
in AUTH48, as agreed earlier.

Thanks for all your comments and suggestions,

Cheers,

Gonzalo