Re: Evaluation: draft-ietf-sip-sctp - The Stream Control Transmission Protocol as a Transport for the Session Initiation Protocol

[Russ Housley <housley@vigilsec.com>]

>                       Yes  No-Objection  Discuss  Abstain
> Russ Housley         [   ]     [   ]     [ X ]     [   ]

I have four comments.

1.  Add "(the Session Initiation Protocol)" after the first use of "SIP" in 
the Abstract.

2.  Please spell out first use of "SRV."

3.  Is the Note in the middle of section 4.1 going to be removed prior to 
publication as an RFC?  If not, then it needs to be reworded.  The RFC 
should not refer to "previous versions of this document."

4.  The following replacement for the Security Considerations section in 
proposed in the ballot:

    The security issues raised in [2] are not worsened by SCTP, provided the
    advice in Section 4 is followed and SCTP over TLS [cite RFC 2436] is
    used where TLS would be required in [2].

TLS is normally used over TCP.  Wouldn't the layering here be SIP over TLS 
over SCTP?