Subject: Re: [secdir] COMMENT: draft-ietf-avt-rtp-toffset

From: Dave Singer <[email-masked]>
Date: Tue, 21 Oct 2008 10:16:29 +0900

At 8:37  -0700 7/10/08, Tim Polk wrote:
>Comment:
>(1) I was amused when I read the security considerations.  It *is* 
>hard to see how informative
>offsets have any security implications, but I appreciate the effort!
>
>I would recommend adding a sentence pointing to RFC 3550 for the core security
>considerations.

added:
<t>The underlying security considerations of <xref target="RFC3550"/> 
should be taken into account.</t>

>
>(2) FYI, [hdrext] is now RFC 5285.  Perhaps that should be added to 
>the RFC Editor Note.

Yes, it is indeed published.

At 2:03  -0600 8/10/08, Shawn M Emery wrote:
>I believe more guidance would help here.  For instance; security 
>considerations should be made based on how applications act upon 
>network jitter information and if the attribute is determined to be 
>sensitive to a DoS attack, for instance, then protecting this 
>information should be made.  Referring to recommendations outlined 
>in the RTP RFC or better.

added:
         <t>It is possible that malicious senders (or systems 
tampering with packets in transit) could send offsets that are 
implausible, could confuse the receiver, or result in calculated 
jitter values that might mislead the sender. Both sender and receiver 
of the transmission offsets and jitter values should take care that 
such behavior does not result in denial-of-service or other 
problems.</t>

>
>Other than that, I see no additional security concerns from that of RTP.

-- 
David Singer
Multimedia Standards, Apple Inc.
_______________________________________________
secdir mailing list
[email-masked]
https://mailman.mit.edu/mailman/listinfo/secdir
_______________________________________________
secdir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/secdir