Re: Draft new version: draft-ietf-simple-msrp-cema-06

Change looks good.....
Anyone...

Martin C. Dolly
Sent to you by AT&T...
America's Fastest Mobile Broadband Network. Rethink Possible.
+1.609.903.3360
-----------
  Sent from my iPhone

On Jun 29, 2012, at 3:47 PM, "Ben Campbell" <[email protected]> wrote:

> (As Chair, adding to the previous...)
> 
> Christer also proposed the following change to section 7.7 to go along with the previous proposed addition:
> 
>>> Section 7.7 currently says:
>>> 
>>>    "There is no way for the endpoints to discover when such an attack is
>>>    taking place though."
>>> 
>>> I guess we should change that to something like:
>>> 
>>>    "It is very hard for the endpoints to detect when such an attack is
>>>    taking place though."
>> 
> 
> 
> If anyone objects to that change, please speak up ASAP.
> 
> 
> Thanks!
> 
> Ben.
> 
> 
> On Jun 27, 2012, at 3:33 PM, Ben Campbell wrote:
> 
>> As Chair:
>> 
>> Hi Everyone:
>> 
>> Christer, thanks for submitting this.
>> 
>> Everyone,  please take a quick look at the security considerations in this version, and send comments ASAP if you see an issue. If you made comments in the WGLC, please confirm whether your comments are addressed (I'm not sure if anyone but me did--maybe Paul?). If we don't see an objection the end of the week, we plan to restart the process to progress this.
>> 
>> Additionally, we've had a Security AD suggestion to add text (probably to section 7.7)  to the effect of the following, which would add SHOULD level normative requirements to watch for changes in a fingerprint for an identity, and warn of any changes. If anyone objects to adding that, please speak up ASAP.
>> 
>>> "When a UA receives a fingerprint, that represents a binding
>>> between the identity as established by TLS and that established
>>> via SDP. As previously noted, the fingerprint is vulnerable to
>>> an active MITM attack from any on-path proxy. UAs SHOULD
>>> therefore locally store fingerprints associated with the
>>> relevant identities when first seen, and SHOULD warn when a
>>> new fingerprint is seen for what otherwise appears to be the
>>> same peer identity. While there are valid reasons for keys
>>> to change from time to time, that ought be the exception,
>>> hence the suggested warning."
>> 
>> 
>> 
>> Thanks!
>> 
>> Ben.
>> 
>> 
>> 
>> 
>> On Jun 25, 2012, at 6:07 PM, Christer Holmberg wrote:
>> 
>>> Hi,
>>> 
>>> Based on Ben's comments, I've submitted a new version (-06) of the cema draft, with some modifications in the security considerations section. The new text should address Ben's issues and suggestions.
>>> 
>>> Regards,
>>> 
>>> Christer
>>> _______________________________________________
>>> Simple mailing list
>>> [email protected]
>>> https://www.ietf.org/mailman/listinfo/simple
>> 
>> _______________________________________________
>> Simple mailing list
>> [email protected]
>> https://www.ietf.org/mailman/listinfo/simple
> 
> _______________________________________________
> Simple mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/simple