Subject: Re: [Gen-art] Gen-ART review of draft-ietf-xrblock-rtcp-xr-bytes-discarded-metric-01

From: Jari Arkko <[email-masked]>
Date: Thu, 20 Feb 2014 14:29:09 +0100

Thanks for the review, Vijay! For what it is worth, I agree with you on it being desirable to document the reason for that sentence, and agree that other documents are not necessarily sufficient to explain the situation.

Jari

On Jan 31, 2014, at 3:45 PM, Vijay K. Gurbani <[email-masked]> wrote:

> On 01/31/2014 08:25 AM, Varun Singh wrote:
>> Hi Vijay,
>> 
>> Apologies for the tardiness, comments inline.
> 
> Varun: No worries.  More inline.
> 
>> In this particular case, we are worried about a side channel attack.
>> The attacker sends a late arriving packet (timestamp in the past) to
>> the receiver and if the receiver sends a discard report with the same
>> number of bytes as the payload of the injected packet, the attacker
>> may infer that no security processing was performed. If it observes
>> no discard report, it may infer that security procedures were
>> performed on the packet.
> 
> Ah, so you can trivially solve this problem by describing the attack in
> the draft, much as you do above.
> 
>> I think one of the reasons not to explicitly write about the threat
>> model is because there are several reason to use and not use
>> SRTP/AVPF. they are covered in ietf-avt-srtp-not-mandatory, and
>> implementors should read that document to make up their mind.
> 
> My reading of draft-ietf-avt-srtp-not-mandatory is that it does not
> absolve RTP extension authors from talking about security, rather it
> exhorts them to talk about the specific security problems exhibited
> by their proposed extension and furthermore, elaborate how to address
> such concerns.
> 
>> I hope the chairs can clarify on how to proceed.
> 
> Cheers,
> 
> - vijay
> -- 
> Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
> 1960 Lucent Lane, Rm. 9C-533, Naperville, Illinois 60563 (USA)
> Email: vkg@{bell-labs.com,acm.org} / [email-masked]
> Web: http://ect.bell-labs.com/who/vkg/  | Calendar: http://goo.gl/x3Ogq
> _______________________________________________
> Gen-art mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/gen-art