Re: [AVTCORE] SRTP: Retransmission or replay attacking? How to discriminate in e2ae environment?

Magnus Westerlund <magnus.westerlund@ericsson.com> Tue, 30 October 2012 09:06 UTC

Message-ID: <508F9899.5000102@ericsson.com>
Date: Tue, 30 Oct 2012 10:06:33 +0100
From: Magnus Westerlund <magnus.westerlund@ericsson.com>
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20121010 Thunderbird/16.0.1
MIME-Version: 1.0
To: avt@ietf.org
References: <DE315914FFC19345B99B2A4B7F595ED00E426885@CNSHJMBX03.ad4.ad.alcatel.com>
In-Reply-To: <DE315914FFC19345B99B2A4B7F595ED00E426885@CNSHJMBX03.ad4.ad.alcatel.com>
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
Subject: Re: [AVTCORE] SRTP: Retransmission or replay attacking? How to discriminate in e2ae environment?
Precedence: list

On 2012-10-30 06:57, HE Bing wrote:
> Dear all,
>  
> RTP/SAVTF is adopted in WebRTC.
> For video stream, SRTP sender will do retransmission for the SRTP
> packets indicated by RTCP FB NACK packets. The retransmitted SRTP
> packets are exactly identical to the original packets (one exception is
> Google Chrome WebRTC use RTP header extension per RFC 5450 so that every
> retransmitted SRTP packet has different header extension from the
> original one)

I would like to point out that for RTP retransmission it is expected
that RFC 4588 is used for the retransmitted packets. That specification
exist to address the issue that retransmitting an RTP packet as an
identical copy doesn't work as it destroys all the statistics and
tracking of packets as well as the below SRTP replay issue.

>  
> Now we see a problem in valid e2ae environment that can be simplified as
> below:
> *A* (Browser)<---(SRTP, SRTCP)--->*IMS boder*<---((RTP, RTCP)--->*B*
> (IMS client)
> Where IMS border works in RTP transparent forwarding mode with
> additional encryption/decryption on browser side.
>  
> If an A party originated packet was lost on the way from IM border to B
> party, this packet will be *marked as received in* IMS border SRTP
> *replay-check list*. Upon receipt of the RTCP FB NACK packet originated
> by B party, A will resend the packet which will be *discarded* by IMS
> border when doing replay checking job.
>  
> Is there any way to resolve this issue?

Use RFC 4588 retransmission payload and this issue goes away.

Cheers

Magnus Westerlund

----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVM
----------------------------------------------------------------------
Ericsson AB                | Phone  +46 10 7148287
Färögatan 6                | Mobile +46 73 0949079
SE-164 80 Stockholm, Sweden| mailto: magnus.westerlund@ericsson.com
----------------------------------------------------------------------

[AVTCORE] SRTP: Retransmission or replay attackin… HE Bing
Re: [AVTCORE] SRTP: Retransmission or replay atta… Magnus Westerlund
Re: [AVTCORE] SRTP: Retransmission or replay atta… HE Bing