Subject: Re: [MMUSIC] Review (Rafferty) of draft-ietf-mmusic-udptl-dtls-02

From: "Gonzalo Salgueiro (gsalguei)" <[email-masked]>
Date: Fri, 20 Dec 2013 22:41:27 +0000

Thanks very much, James.  We'll go through your review comments and respond to each of the individually.  Expect some delay in response due to the upcoming Holidays.

Happy Holidays!

Gonzalo

On Dec 20, 2013, at 5:31 PM, James Rafferty <[email-masked]> wrote:

> This is a review ofdraft-ietf-mmusic-udptl-dtls-02.   In general, the draft is in good shape.  My comments and suggestions are included below.
> 
> Section 1 - first bullet:  add "the" before application layer
> 
> Section 1, Page 2  - On the paragraph before Table 2, the current last sentence reads:  "The protocol stack for integrity and confidentiality protected fax transport using UDPTL over DTLS is shown in Table 2."
> 
> A couple of word changes would make it read more clearly:
> "The protocol stack which enhances fax transport to offer integrity and confidentiality using UDPTL over DTLS is shown in Table 2."
> 
> Section 1, Page 3:  Under the "primary motivations" , I'd suggest broadening the applicability of the last bullet point to read:
> 
> "3GPP and the IP fax community need a mechanism to transport UDPTL over DTLS  in order to provide secure fax in IMS and other SIP-based networks."
> 
> Section 2
> 
> for the 2nd sentence of the second paragraph, clarify by replacing "it" by "session"
> 
> Section 5 - Security Considerations
> 
> I think it would help to pull in material about the threat model before jumping directly into the solution (my latest draft got dinged in the IESG security review on this point).
> 
> From a fax community perspective, the relevant threats seem to be:
> 
> 1.  Confidentiality - Address potential for 3rd parties to intercept and decode messages
> 
> 2.  Integrity - Ensure that the parties exchanging the messages are properly authenticated and that the message has not been altered during transport.
> 
> These points are addressed somewhat in the body of this section, but it would be useful to start with the threats model and then identify how the solution meets the requirements.
> 
> Section 6 - IANA Considerations
> 
> For consistency with the IANA content for "proto"  in RFC 4566, it looks like the entry for the SDP name in Table 3 should be in quotes or "UDP/TLS/UDPTL"
> 
> Example A.3
> 
> This is an important example, since most (if not all) current UDPTL sessions will start as audio sessions.
> 
> To highlight this point, I'd suggest adding a second sentence in this section such as:
> 
> "By current conventions, most non-secured UDPTL sessions are initiated via a re-INVITE after the SIP session has begun as an audio session and this example shows to address this scenario for initiating UDPTL sessions secured via DTLS."
> 
> That concludes my comments on this draft.
> 
> Regards,
> 
> James
> 
>