Subject: [secdir] secdir review of draft-roach-sip-http-subscribe-06

From: Tina TSOU <[email-masked]>
Date: Tue, 26 Jan 2010 10:11:28 +0100

Hi,
I have reviewed this document as part of the
security directorate's ongoing effort to review all IETF documents
being processed by the IESG.  These comments were written primarily
for the benefit of the security area directors.  Document editors and
WG chairs should treat these comments just like any other last call
comments.

Comments follow:
1) It is possible that the message/http NOTIFY message bodies may  
contain sensitive information. This is related to the statement at the  
end of the existing Security Considerations text that care should be  
taken to apply the same controls over access to entity information to  
SIP/SIPS subscribers as to users using other protocols. Additional  
text in the Security Considerations section should point out that if  
the NOTIFY requests may return sensitive information, that information  
should be protected in transit by, for example, requiring that the  
subscription use SIPS rather than SIP.

2) Along with this, some reference to RFC 5630 might be valuable, both  
to indicate the limitations of SIPS and to indicate how it should be  
implemented.

B. R.
Tina
http://tinatsou.weebly.com/contact.html