[secdir] secdir review of draft-ietf-sipping-sip-offeranswer-10.txt

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

The goal of the document is to document the offer/answer exchanges
used in the SIP framework to establish and update multimedia sessions.
This informational document does not define new protocol exchanges;
its goal is to clarify what can be found in various RFCs. The text in
the security considerations says:

   There are not any security issues beyond the referenced RFCs.

While this might be true, I would have preferred to have a somewhat
more explicit discussion and more precise pointers which parts of the
security considerations in the "referenced RFCs" (really all?) apply.
The document describes some offer/answer interactions where the
correct behaviour is not clear and it would be good to spell out
whether any of the described offer/answer scenarios can be exploited.
If not, having a statement that they can't be exploited and why would
be nice to have. (For example, spell out whether SIP integrity
protection and authentication are sufficient to mitigate any possible
attacks.)

Editorial:

- It would be nice for readers who are not too deeply involved with
  SIP if all acronyms (UAC, UAS, 3ppc, ...) are expanded on first
  usage.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
_______________________________________________
secdir mailing list
secdir@ietf.org
https://www.ietf.org/mailman/listinfo/secdir