Last Call Review of draft-ietf-avtext-rid-04
review-ietf-avtext-rid-04-secdir-lc-orman-2016-08-11-00
| Request | Review of | draft-ietf-avtext-rid |
|---|---|---|
| Requested rev. | no specific revision (document currently at 09) | |
| Type | Last Call Review | |
| Team | Security Area Directorate (secdir) | |
| Deadline | 2016-08-12 | |
| Requested | 2016-08-04 | |
| Authors | Adam Roach, Suhas Nandakumar, Peter Thatcher | |
| Draft last updated | 2016-08-11 | |
| Completed reviews |
Secdir Last Call review of -04 by Hilarie Orman
(diff)
Opsdir Last Call review of -04 by Jürgen Schönwälder (diff) |
|
| Assignment | Reviewer | Hilarie Orman |
| State | Completed | |
| Review | review-ietf-avtext-rid-04-secdir-lc-orman-2016-08-11 | |
| Reviewed rev. | 04 (document currently at 09) | |
| Review result | Has Issues | |
| Review completed: | 2016-08-11 |
Review
review-ietf-avtext-rid-04-secdir-lc-orman-2016-08-11
Security review of RTP Stream Identifier Source Description (SDES) draft-ietf-avtext-rid-04 Do not be alarmed. I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. We begin by quoting from the document: "Abstract This document defines and registers two new RTCP SDES items. One, named RtpStreamId, is used for unique identification of RTP streams. The other, RepairedRtpStreamId, can be used to identify which stream a redundancy RTP stream is to be used to repair. Security considerations: The actual identifiers used for RtpStreamIds (and therefore RepairedRtpStreamIds) are expected to be opaque." "Opaque" seems to mean "no one cares what it is." Nonetheless, a protocol should give some guidance about this. Taking the value from a global 64-bit counter, for example, could leak information about the global state of the machine. Having a short counter for each session with a starting value of 0 would probably be OK. Having a short counter start at a random value and wraps around would probably be OK. The "terminology" section could be improved by EAFMA and RUP (expanding a few more acronyms and removing unused phrases). MSID and SSRC are not expanded; "encoded stream" is never used. Hilarie