Re: [AVTCORE] [dispatch] New proposal do declare SDP Security Descriptions (RFC4568) Historic

Hi Magnus,

This seems like a reasonable work item for MMUSIC to me (and a reasonable
goal as well).

regards

Ted

On Mon, Jul 12, 2021 at 1:15 PM Magnus Westerlund <magnus.westerlund=
40ericsson.com@dmarc.ietf.org> wrote:

> Hi,
>
> John and I have a draft that proposes that RFC 4568 (*Session Description
> Protocol (SDP) Security Descriptions for Media Streams)* should be
> declared Historic. As the draft explains the security level SDP Security
> Description provide is not on the level on could expected by an IETF in
> force proposed standard and there exist alternatives.
>
> We currently point this draft to Dispatch as we are a bit uncertain if
> this should be handled in MMUSIC WG or somewhere else?
> Therefore we proposes that this draft is discussed on the dispatch list
> until dispatched.
>
> Cheers
>
> Magnus Westerlund
>
>
> Name:           draft-mattsson-dispatch-sdes-dont-dont-dont
> Revision:       00
> Title:          SDP Security Descriptions is NOT RECOMMENDED and Historic
> Document date:  2021-07-12
> Group:          Individual Submission
> Pages:          8
> URL:
> https://www.ietf.org/archive/id/draft-mattsson-dispatch-sdes-dont-dont-dont-00.txt
> Status:
> https://datatracker.ietf.org/doc/draft-mattsson-dispatch-sdes-dont-dont-dont/
> Htmlized:
> https://datatracker.ietf.org/doc/html/draft-mattsson-dispatch-sdes-dont-dont-dont
>
>
> Abstract:
>    Key exchange without forward secrecy enables pervasive monitoring.
>    Massive pervasive monitoring attacks relying on key exchange without
>    forward secrecy have been reported, and many more have likely
>    happened without ever being reported.  If key exchange without
>    Diffie-Hellman is used, access to long-term keys enable passive
>    attackers to compromise past and future sessions.  Entities can get
>    access to long-term key material in different ways: physical attacks,
>    hacking, social engineering attacks, espionage, or by simply
>    demanding access to keying material with or without a court order.
>    Session Description Protocol (SDP) Security Descriptions (RFC 4568)
>    does not offer PFS and has a large number of additional significant
>    security weaknesses.  This document specifies that use of the SDP
>    Security Descriptions is NOT RECOMMENDED.  New deployments SHOULD
>    forbid support of SDP Security Descriptions.
>
>    This document reclassifies RFC 4568 (SDP Security Descriptions) to
>    Historic Status and also obsoletes RFC 4568.
>
>    This document updates RFC 7201 (Options for Securing RTP Sessions) to
>    note that SDP Security Descriptions SHOULD NOT be used.
> _______________________________________________
> dispatch mailing list
> dispatch@ietf.org
> https://www.ietf.org/mailman/listinfo/dispatch
>