Last Call Review of draft-ietf-sipbrandy-osrtp-09

Request Review of draft-ietf-sipbrandy-osrtp
Requested rev. no specific revision (document currently at 10)
Type Last Call Review
Team Transport Area Review Team (tsvart)
Deadline 2019-05-16
Requested 2019-05-02
Authors Alan Johnston, Bernard Aboba, Andrew Hutton, Roland Jesske, Thomas Stach
Draft last updated 2019-05-16
Completed reviews Tsvart Last Call review of -09 by Allison Mankin (diff)
Secdir Last Call review of -09 by Sean Turner (diff)
Genart Last Call review of -09 by Elwyn Davies (diff)
Assignment Reviewer Allison Mankin
State Completed
Review review-ietf-sipbrandy-osrtp-09-tsvart-lc-mankin-2019-05-16
Posted at
Reviewed rev. 09 (document currently at 10)
Review result Ready with Nits
Review completed: 2019-05-16


This document has been reviewed as part of the transport area review team's
ongoing effort to review key IETF documents. These comments were written
primarily for the transport area directors, but are copied to the document's
authors and WG to allow them to address any issues raised and also to the IETF
discussion list for information.

When done at the time of IETF Last Call, the authors should consider this
review as part of the last-call comments they receive. Please always CC if you reply to or forward this review.

This document doesn't raise any specifically transport-focused questions 
for me.  I appreciated the clear discussion of the types of security 
arrangements that can be made by Offer-Answer SIP and I found the draft 
a valuable read.  The implementation section is quite interesting.

I have a couple of issues with Section 4, though they are not about transport. 
So I'm going to mention them, but defer to the Security Area beyond just 
flagging them. Hence, I've marked the draft Ready with Nits rather than 
Ready with Issues.  

1. I find the two sentences below inconsistent with each other, with a small-m 
"must" and a cited "SHOULD" for the same issue:

      For SDP Security Descriptions key agreement [RFC4568], an
      authenticated signaling channel does not need to be used with
      OSRTP if it is not available, although an encrypted signaling
      channel must still be used.

      Section 8.3 of [RFC7435] requires that any messages that contain SRTP keys be
      encrypted, and further says that encryption "SHOULD" provide end-to-
      end confidentiality protection if intermediaries that could inspect
      the SDP message are present.

Also, there isn't a section 8.3 of RFC7435.  Is this an incorrect reference or a reference
to a pre-publication version of RFC7435?

2. I feel the sentence below misrepresents RFC7435 with its wording "requirement 
for end-to-end confidentiality."  RFC7435 has a preference for confidentiality of 
authentication if there is authentication, but TOFU means there isn't a requirement.  
The sentence is too general.

   At the time of this writing, it is
   understood that the [RFC7435] requirement for end-to-end
   confidentiality protection is commonly ignored.

The section 4 reference to section 8.3 of RFC7435 needs to be fixed.