Subject: [Speermint] draft-niccolini-speermint-voipthreats-05

From: Cullen Jennings <[email-masked]>
Date: Fri, 14 Nov 2008 18:51:54 -0700

Two trivial comments ....

Section 2.3.1 password cracking.

I understand how seeing a single digest transaction allows an offline  
dictionary attack on weak passwords but why how do you come to the  
conclusion

       challenge-response authentication mechanism of
       SIP is not secure if the attacker is able to eavesdrop a
       sufficient number of SIP authentication messages exchanged  
between
       a SIP server and a SIP client.

Section 4.8 - you mention here an assumption about a PKI  
infrastructure being in place. I think it would be better to mention  
that where you discuss the usage of TLS because is it the same one  
either way.

Cullen in my individual contributor role

_______________________________________________
Speermint mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/speermint