[rtcweb] security-arch: Identity Assertions

Michael Procter <michael@voip.co.uk> Tue, 15 July 2014 12:07 UTC

MIME-Version: 1.0
Date: Tue, 15 Jul 2014 13:07:49 +0100
Message-ID: <CAPms+wTM=z1--PaimYW51Q4Ou9A1u+HuXEjZ=3dVY6WJL2=4=g@mail.gmail.com>
From: Michael Procter <michael@voip.co.uk>
To: "<rtcweb@ietf.org>" <rtcweb@ietf.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: http://mailarchive.ietf.org/arch/msg/rtcweb/aVBzDEHZFGRcpcBKif2Wxd1XUH8
Subject: [rtcweb] security-arch: Identity Assertions
Precedence: list

I've been reading the security-arch draft, and I think there is a part
that should be removed.  In section 5.6.4.2, the second paragraph
starts:

   Each identity attribute should be paired (and attests to) with an
   a=fingerprint attribute and therefore can exist either at the session
   or media level. Multiple identity attributes may appear at either level,
   though it is RECOMMENDED that implementations not do this, [...]

This conflicts with the next section which begins:

  The identity attribute is session level only.

The notion of pairing identity with fingerprint attributes also seems
to conflict with the third paragraph which contains:

   The a=identity attribute MUST include all fingerprint values that are
   included in a=fingerprint lines

I think the whole of the second paragraph can be removed without loss,
since the parts that don't conflict appear to be addressed in the
third paragraph of 5.6.4.2 anyway.

Regards,

Michael

[rtcweb] security-arch: Identity Assertions Michael Procter