Re: [AVTCORE] I-D Action: draft-ietf-avt-srtp-not-mandatory-11.txt

[Magnus Westerlund <[e-mail]>]

Hi Harald,


On 2012-11-25 00:46, Harald Alvestrand wrote:
> On 11/19/2012 11:59 PM, Colin Perkins wrote:

> One thing I did not understand about the new section 6 ....
> It describes RTP/AVPF as a profile that is an example of where a single
> security mechanism is not reasonable to mandate, because it's used in
> many other contexts.
> I think that's OK - but isn't it true that RTP/AVPF *disallows* the use
> of SRTP, since it would then be RTP/SAVPF?
> 
> This can be confusing to the reader - it may be clearer if one mentions
> explicitly that the RTP/AVPF, which is a set of building blocks that
> don't need a security mandate, is used to build RTP/SAVPF, which *is* a
> security mandate.
> 
> Or am I the one confused?

I guess you are getting tripped up on this sentence:

   In other cases, though,
   an RTP profile is applicable to such a wide range of applications
   that it would not make sense for that profile to mandate particular
   security building blocks be used (the RTP/AVPF profile [RFC4585] is
   an example of this type of RTP profile, since it provides building
   blocks that can be used in different styles of application).

This is an example why RTP profiles, independent of which profile it may
be is not the appropriate level of putting in the mandatory to implement
security solution alternative. And frankly SAVPF and SAVP is only half a
security mandate, they lack key-management and without a mandatory to
implement key-management solution they do not specify a MTI security
solution.

And if I count correctly in draft-ietf-avtcore-rtp-security-options
there are at least 11 options for keying SRTP.

Cheers

Magnus Westerlund

----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVM
----------------------------------------------------------------------
Ericsson AB                | Phone  [phone]
Färögatan 6                | Mobile [phone]
SE-164 80 Stockholm, Sweden| mailto: [e-mail]
----------------------------------------------------------------------