I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The summary of the review is Ready with One Issue Section 5.2, First paragraph, last sentence: "The implementation MAY stop and report an error if it considers use of this specification mandatory for the RTP stream." If the implementation considers this to be *mandatory*, why is the above statement state "MAY stop and report an error"? It seems to me that in this case, at least a SHOULD is warranted here. Am I missing something? Regards, Rifaat