Subject: Re: [Speermint] AD review: draft-ietf-speermint-voipthreats-05

From: Gonzalo Camarillo <[email-masked]>
Date: Thu, 16 Dec 2010 16:32:50 +0200

Hi,

I do not seem to have received an answer to my email below. If I have
missed it, could you please resend it?

Thanks,

Gonzalo

On 16/11/2010 1:49 PM, Gonzalo Camarillo wrote:
> Hi,
> 
> thanks for having submitted a new revision of this draft:
> 
> http://tools.ietf.org/html/draft-ietf-speermint-voipthreats-06
> 
> This revision addresses most of my comments below. However, I do not
> think I got an answer to the following question:
> 
>> While message modification and eavesdropping is included in the
>> threats against SF and MF, they do not seem to appear in the threats
>> against LRF and LUF. Why?
> 
> Also, the reasons why Section 4.5 recommends TCP over UDP are still not
> clear. UDP over DTLS would meet the requirements in both Sections 3.2
> and 4.5.
> 
> Thanks,
> 
> Gonzalo
> 
> 
> On 29/09/2010 5:15 PM, Gonzalo Camarillo wrote:
>> Hi,
>>
>> a couple of days ago I received a publication request for the following
>> draft:
>>
>> https://datatracker.ietf.org/doc/draft-ietf-speermint-voipthreats/
>>
>> Here you have my AD review of the draft (see below). The authors should
>> be able to address all my comments fairly quickly. As soon as they
>> revise the draft I will initiate its IETF LC.
>>
>> Thanks,
>>
>> Gonzalo
>>
>>
>> draft-ietf-speermint-voipthreats-05
>>
>> Expand acronyms on their first use (e.g., SPEERMINT in the title and
>> VoIP in the Introduction).
>>
>> The Abstract and the Introduction attempt to explain the relationship
>> between this draft and draft-ietf-speermint-requirements. However,
>> Section 3.1 does a better job at that. Could you please clarify in the
>> Introduction that the requirements in draft-ietf-speermint-requirements
>> were derived from the threats documented in this draft? Also, please
>> clarify that in addition to be the base for those requirements, this
>> draft provides countermeasures to meet those requirements. Any SPEERMINT
>> expert will probably understand that by reading the Abstract and the
>> Introduction but clarifying those points will help readers who have not
>> been that involved in the process.
>>
>> While message modification and eavesdropping is included in the
>> threats against SF and MF, they do not seem to appear in the threats
>> against LRF and LUF. Why?
>>
>> Section 4.5 recommends to use TCP instead of UDP. That advice is great,
>> but the reasons Section 4.5 discusses are not that strong. The fact that
>> the linux kernel has improved is irrelevant if an operator uses
>> non-linux boxes. Also, an operator using UDP over IPsec, for instance,
>> will not face the problems described there. The main recommendation in
>> Section 4.5 seems to actually be to use an integrity protection
>> mechanism. Clarifying that section would be useful.
>>
>> [refs.sbcfuncs] has been published as RFC 5853
>>
>> A few references only include the title and the author fields. Adding
>> the venue where they were published would be useful.
>>
> 
> _______________________________________________
> Speermint mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/speermint
>