Re: [Sip] Doc we need to have draft-ietf-sip-dtls-srtp-framework-01 on the -71 agenda?

[Jonathan Rosenberg <jdrosen at cisco.com>]

Dean Willis wrote:
> Is there any need for discussion of the DTLS framework
> (draft-ietf-sip-dtls-srtp-framework-01) during our meeting?
> 
> The authors think that it is pretty much ready for WGLC and that all
> known issues have been resolved.

I do not agree.

One of the points I raise in my rfc4474-concerns draft is that dtls-srtp 
is basing integrity of the fingerprint on 4474, and that 4474 does not 
provide integrity against intermediary modifications of the number, and 
even for user at domain names this can happen.

I think this needs to be called out in the draft. The security 
considerations section does not discuss this.

-Jonathan R.


-- 
Jonathan D. Rosenberg, Ph.D.                   499 Thornall St.
Cisco Fellow                                   Edison, NJ 08837
Cisco, Voice Technology Group
jdrosen at cisco.com
http://www.jdrosen.net                         PHONE: (408) 902-3084
http://www.cisco.com
_______________________________________________
Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use sip-implementors at cs.columbia.edu for questions on current sip
Use sipping at ietf.org for new developments on the application of sip