Re: [AVT] Re: Changes in draft-ietf-avt-2833bis-13.txt

[Colin Perkins <[e-mail]>]

I agree with Magnus Westerlund: it makes sense to say one SHOULD  
implement SRTP, since it provides appropriate security for many  
environments, but we cannot absolutely mandate it, since there are  
valid uses of RTP where SRTP isn't the right security solution.

Colin




On 9 May 2006, at 14:36, Tom-PT Taylor wrote:
> Magnus Nyström is correct as far as my intent was concerned -- I  
> goofed. However, I think I'll keep my head down while the broader  
> issues are thrashed out. I do think, now that I've looked at it,  
> that the Security Considerations section of RFC 3550 could have  
> been more thoroughly developed, but as a member of the AVT WG, I  
> have to take some responsibility for that.
>
> Earlier in this thread Magnus W. mentioned draft-westerlund-avt-rtp- 
> howto-00. I'll try to contribute when that is reissued, to make  
> amends for my earlier neglect.
>
> Magnus Westerlund wrote:
>> Magnus Nyström wrote:
>>> Thanks for this, Tom.
>>>
>>> I have one comment. You write:
>>>
>>>> "To meet the need for protection both of confidentiality and  
>>>> integrity, this specification requires that compliant  
>>>> implementations also implement the Secure Real-time Transport  
>>>> Protocol (SRTP) [RFC3711].
>>>
>>> If this is a normative statement (and it looks like it), perhaps  
>>> it should be rephrased to:
>>>
>>> "To meet the need for protection both of confidentiality and  
>>> integrity, compliant implementations MUST also implement [or  
>>> support] the Secure Real-time Transport Protocol (SRTP) [RFC3711]."
>>>
>> Hi Magnus,
>> There is one problem with mandating SRTP as the security  
>> mechanism. It is not suitable for all deployment scenarios that  
>> RTP is used in. Due to this we have been very cautious to mandate.  
>> We gladly recommend SRTP as it works in most deployments. RTPs  
>> wide deployment potential do create an issue here.
>> I think we are getting to a situation where we might need to  
>> clarify the usage of security mechanism for RTP and for which  
>> cases they are suitable to adapt for different applications.
>> cheers
>> Magnus Westerlund
>> Multimedia Technologies, Ericsson Research EAB/TVA/A
>> --------------------------------------------------------------------- 
>> -
>> Ericsson AB                | Phone [phone]
>> Torshamsgatan 23           | Fax   [phone]
>> S-164 80 Stockholm, Sweden | mailto: [e-mail]
>
>
> _______________________________________________
> Audio/Video Transport Working Group
> [e-mail]
> https://www1.ietf.org/mailman/listinfo/avt


_______________________________________________
Audio/Video Transport Working Group
[e-mail]
https://www1.ietf.org/mailman/listinfo/avt