Re: [AVTCORE] I-D Action: draft-ietf-avt-srtp-not-mandatory-11.txt

["David McGrew (mcgrew)" <[e-mail]>]

On 11/26/12 3:49 AM, "Harald Alvestrand" <[e-mail]> wrote:

>On 11/26/2012 09:08 AM, Magnus Westerlund wrote:
>> Hi Harald,
>>
>>
>> On 2012-11-25 00:46, Harald Alvestrand wrote:
>>> On 11/19/2012 11:59 PM, Colin Perkins wrote:
>>> One thing I did not understand about the new section 6 ....
>>> It describes RTP/AVPF as a profile that is an example of where a single
>>> security mechanism is not reasonable to mandate, because it's used in
>>> many other contexts.
>>> I think that's OK - but isn't it true that RTP/AVPF *disallows* the use
>>> of SRTP, since it would then be RTP/SAVPF?
>>>
>>> This can be confusing to the reader - it may be clearer if one mentions
>>> explicitly that the RTP/AVPF, which is a set of building blocks that
>>> don't need a security mandate, is used to build RTP/SAVPF, which *is* a
>>> security mandate.
>>>
>>> Or am I the one confused?
>> I guess you are getting tripped up on this sentence:
>>
>>     In other cases, though,
>>     an RTP profile is applicable to such a wide range of applications
>>     that it would not make sense for that profile to mandate particular
>>     security building blocks be used (the RTP/AVPF profile [RFC4585] is
>>     an example of this type of RTP profile, since it provides building
>>     blocks that can be used in different styles of application).
>>
>> This is an example why RTP profiles, independent of which profile it may
>> be is not the appropriate level of putting in the mandatory to implement
>> security solution alternative. And frankly SAVPF and SAVP is only half a
>> security mandate, they lack key-management and without a mandatory to
>> implement key-management solution they do not specify a MTI security
>> solution.
>Yes, my opinion of the usefulness of the RTP "profile" field is
>sometimes acerbic.
>SAVP(F) mandates use of SRTP, but that gets you only some of the way.
>>
>> And if I count correctly in draft-ietf-avtcore-rtp-security-options
>> there are at least 11 options for keying SRTP.
>Sigh.

Eleven keying method sounds right; that would be DTLS-SRTP, SDP Security
Descriptions, EKT, plus the eight different MIKEY methods.  Too many
options, but not all of them are standards track.

David

>>
>> Cheers
>>
>> Magnus Westerlund
>>
>> ----------------------------------------------------------------------
>> Multimedia Technologies, Ericsson Research EAB/TVM
>> ----------------------------------------------------------------------
>> Ericsson AB                | Phone  [phone]
>> Färögatan 6                | Mobile [phone]
>> SE-164 80 Stockholm, Sweden| mailto: [e-mail]
>> ----------------------------------------------------------------------
>>
>
>_______________________________________________
>Audio/Video Transport Core Maintenance
>[e-mail]
>https://www.ietf.org/mailman/listinfo/avt