Re: [AVTCORE] I-D Action: draft-ietf-avt-srtp-not-mandatory-11.txt

[Harald Alvestrand <[e-mail]>]

On 11/26/2012 09:08 AM, Magnus Westerlund wrote:
> Hi Harald,
>
>
> On 2012-11-25 00:46, Harald Alvestrand wrote:
>> On 11/19/2012 11:59 PM, Colin Perkins wrote:
>> One thing I did not understand about the new section 6 ....
>> It describes RTP/AVPF as a profile that is an example of where a single
>> security mechanism is not reasonable to mandate, because it's used in
>> many other contexts.
>> I think that's OK - but isn't it true that RTP/AVPF *disallows* the use
>> of SRTP, since it would then be RTP/SAVPF?
>>
>> This can be confusing to the reader - it may be clearer if one mentions
>> explicitly that the RTP/AVPF, which is a set of building blocks that
>> don't need a security mandate, is used to build RTP/SAVPF, which *is* a
>> security mandate.
>>
>> Or am I the one confused?
> I guess you are getting tripped up on this sentence:
>
>     In other cases, though,
>     an RTP profile is applicable to such a wide range of applications
>     that it would not make sense for that profile to mandate particular
>     security building blocks be used (the RTP/AVPF profile [RFC4585] is
>     an example of this type of RTP profile, since it provides building
>     blocks that can be used in different styles of application).
>
> This is an example why RTP profiles, independent of which profile it may
> be is not the appropriate level of putting in the mandatory to implement
> security solution alternative. And frankly SAVPF and SAVP is only half a
> security mandate, they lack key-management and without a mandatory to
> implement key-management solution they do not specify a MTI security
> solution.
Yes, my opinion of the usefulness of the RTP "profile" field is 
sometimes acerbic.
SAVP(F) mandates use of SRTP, but that gets you only some of the way.
>
> And if I count correctly in draft-ietf-avtcore-rtp-security-options
> there are at least 11 options for keying SRTP.
Sigh.
>
> Cheers
>
> Magnus Westerlund
>
> ----------------------------------------------------------------------
> Multimedia Technologies, Ericsson Research EAB/TVM
> ----------------------------------------------------------------------
> Ericsson AB                | Phone  [phone]
> Färögatan 6                | Mobile [phone]
> SE-164 80 Stockholm, Sweden| mailto: [e-mail]
> ----------------------------------------------------------------------
>