Last Call Review of draft-ietf-sipbrandy-osrtp-09
review-ietf-sipbrandy-osrtp-09-tsvart-lc-mankin-2019-05-16-00

This document has been reviewed as part of the transport area review team's
ongoing effort to review key IETF documents. These comments were written
primarily for the transport area directors, but are copied to the document's
authors and WG to allow them to address any issues raised and also to the IETF
discussion list for information.

When done at the time of IETF Last Call, the authors should consider this
review as part of the last-call comments they receive. Please always CC
tsv-art@ietf.org if you reply to or forward this review.

This document doesn't raise any specifically transport-focused questions 
for me.  I appreciated the clear discussion of the types of security 
arrangements that can be made by Offer-Answer SIP and I found the draft 
a valuable read.  The implementation section is quite interesting.

I have a couple of issues with Section 4, though they are not about transport. 
So I'm going to mention them, but defer to the Security Area beyond just 
flagging them. Hence, I've marked the draft Ready with Nits rather than 
Ready with Issues.  

1. I find the two sentences below inconsistent with each other, with a small-m 
"must" and a cited "SHOULD" for the same issue:

      For SDP Security Descriptions key agreement [RFC4568], an
      authenticated signaling channel does not need to be used with
      OSRTP if it is not available, although an encrypted signaling
      channel must still be used.

      Section 8.3 of [RFC7435] requires that any messages that contain SRTP keys be
      encrypted, and further says that encryption "SHOULD" provide end-to-
      end confidentiality protection if intermediaries that could inspect
      the SDP message are present.

Also, there isn't a section 8.3 of RFC7435.  Is this an incorrect reference or a reference
to a pre-publication version of RFC7435?

2. I feel the sentence below misrepresents RFC7435 with its wording "requirement 
for end-to-end confidentiality."  RFC7435 has a preference for confidentiality of 
authentication if there is authentication, but TOFU means there isn't a requirement.  
The sentence is too general.

   At the time of this writing, it is
   understood that the [RFC7435] requirement for end-to-end
   confidentiality protection is commonly ignored.

Editorial/Nits
The section 4 reference to section 8.3 of RFC7435 needs to be fixed.