Authentication, Authorization, and Accounting Requirements for the Session Initiation Protocol (SIP)
draft-ietf-sipping-aaa-req-04

RFC Editor note added to satisfy Russ's comment:

4 Security Considerations

  This document is informational in nature, so it does
  not directly affect the security of the Internet. However,
  security is a basic requirement of this work. Section
  2.1.9 contains security requirements related to the
  SIP-AAA interface.


New:

4 Security Considerations

  Security is a critical requirement of AAA for the
  Session Initiation Protocol.  Section 2.1.9 describes
  the threats and security requirements.  Section 2.2
  elaborates on the authentication and authorization
  requirements.

Sent mail to Russ (cc the editors) with a proposed RFC Editor note to address his comment better:

4 Security Considerations

  This document is informational in nature, so it does not directly
  affect the security of the Internet. However, security is a basic
  requirement of this work. Section 2.1.9 contains security
  requirements related to the SIP-AAA interface.


New:


4 Security Considerations

  Security is a critical requirement of AAA for the Session Initiation
  Protocol.  Section 2.1.9 describes the threats and security
  requirements.  Section 2.2 elaborates on the authentication and
  authorization requirements.

[Note]: 'Revision 04 addresses comments by Bernard Aboba for ops-directorate and Russ Housley on Security Considerations; a discussion among Bernard, editors, and myself resulted in adding a section specifyng limitations of RADIUS, but making this topic explicit.  Next step will be to clear the draft with Bert and Russ, and issue Approve message.  Also to enter review discussion in tracker, now that tracker is not broken again.' has been cleared by Allison Mankin

[Note]: 'Revision 04 addresses comments by Bernard Aboba for ops-directorate and Russ Housley on Security Considerations; a discussion among Bernard, editors, and myself resulted in adding a section specifyng limitations of RADIUS, but making this topic explicit.  Next step will be to clear the draft with Bert and Russ, and issue Approve message.  Also to enter review discussion in tracker, now that tracker is not broken again.' added by Allison Mankin

Revision 04 addresses comments by Bernard Aboba for ops-directorate and Russ Housley on Security Considerations; a discussion among Bernard, editors, and myself resulted in adding a section specifyng limitations of RADIUS, but making this topic explicit.  Next step will be to clear the draft with Bert and Russ, and issue Approve message.  Also to enter review discussion in tracker, now that tracker is not broken again.

[Note]: 'Revision 04 addresses comments by Bernard Aboba for ops-directorate and Russ Housley on Security Considerations; a discussion among Bernard, editors, and myself resulted in adding a section specifyng limitations of RADIUS, but making this topic explicit.  Next step will be to clear the draft with Bert and Russ, and issue Approve message.  Also to enter review discussion in tracker, now that tracker is not broken again.' added by Allison Mankin

[Note]: 'Requirements were considered quite carefully on mailing list and several sessions.  The Security Considerations section will have an RFC Editor Note like:  Security risks and required security services are discussed above in Section 9.  These are very important for AAA in SIP. ' added by Amy Vezza

The security considerations section is pretty lame.  Given the other discussion of authentication and authorization in the document, I expected a better synopsis.  At a minimum, a pointer to security-relevant sections is appropriate.

Requirements were considered quite carefully on mailing list and several sessions.  The Security Considerations section will have an RFC Editor Note like:  Security risks and required security services are discussed above in Section 9.  These are very important for AAA in SIP.   

[Note]: 'Requirements were considered quite carefully on mailing list and several sessions.  The Security Considerations section will have an RFC Editor Note like:  Security risks and required security services are discussed above in Section 9.  These are very important for AAA in SIP.   ' added by Allison Mankin

Requirements were considered quite carefully on mailing list and several sessions.  The Security Considerations section will have an RFC Editor Note like:  Security risks and required security services are discussed above in Section 9.  These are very important for AAA in SIP.   

[Note]: 'Requirements were considered quite carefully on mailing list and several sessions.  The Security Considerations section will have an RFC Editor Note like:  Security risks and required security services are discussed above in Section 9.  These are very important for AAA in SIP.   ' added by Allison Mankin