Subject: [MMUSIC] Brief Cross-WG review - draft-ietf-mmusic-comedia-tls

From: Allison Mankin <[email-masked]>
Date: Mon, 02 Jan 2006 08:44:37 -0800

The Multiparty Multimedia Session Control (MMUSIC) WG 
has completed IETF Last Call on a document related to TLS
called :

 Connection-Oriented Media Transport over the TLS
 Protocol in the Session Descriptoin Protocol (SDP)
  draft-ietf-mmusic-comedia-tls-05.txt

comedia stands for connected media

We (Sec ADs, TSV ADs) realized we should have the TLS WG
give a quick review of the document, since there hasn't
been a look by this working group, though there
have been reviews by security experts with some TLS
expertise.

This document is a dependency for three others, and
it is being reviewed by the IESG on Thursday.  In the
busy-ness of the holidays I wrote this message on Dec
26th, but did not notice when an SMTP hiccup caused the 
email not to go before I went with my family for some
email-free holiday (just back).  If it's possible for
someone give the draft a read this week despite the short
notice, that would be appreciated.

Allison

_______________________________________________
mmusic mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mmusic

---

From: Allison Mankin <[email-masked]>
Date: Tue, 03 Jan 2006 09:45:54 -0800

> 
> > One other question -- in the IESG review, the issue was raised that
> > there's not currently an IANA registry for textual names of hash
> > functions.  I agreed to add an IANA considerations section for this
> > purpose, but I was wondering if there's interest in having this
> > registry be more broadly scoped than just for comedia-tls?
> 
> Well, as far as TLS goes, we only use integer code points, so this
> wouldn't buy us anything, but speaking personally I think this
> would be a good idea.

Ekr,

I somehow missed Jonathan's original question about this.  I'll support
making this registry broad-based as long as we don't have to troubleshoot
it a lot from the security side.  Essentially this is going to be
an IANA space for SDP-folk determined names of the algorithms
from RFCs 3280 and 4055 (and later, any RFCs which update 4055).

The reason I don't want to use the broad registry if it entails
debugging is that it's not very likely to be in the consciousness of 
future security developers, not being integrated into a reference
security RFC, and there's not much precedent (if any) for using
the same registry for multiple protocols.  

Allison