Re: [AVT] FW: New Version Notificationfor draft-begen-avt-rtp-cnames-01

> -----Original Message-----
> From: avt-bounces@ietf.org [mailto:avt-bounces@ietf.org] On 
> Behalf Of Roni Even
> Sent: Thursday, May 20, 2010 12:06 AM
> To: 'Dan Wing'; 'Ali C. Begen (abegen)'; avt@ietf.org
> Cc: draft-begen-avt-rtp-cnames@tools.ietf.org
> Subject: Re: [AVT] FW: New Version Notificationfor 
> draft-begen-avt-rtp-cnames-01
> 
> Hi,
> 
> > 
> > * Question: Are there any ideas on the table for generating a unique
> > identifier that wouldn't be useful for traffic analysis?  That is, a
> > unique
> > identifier that is generated on each call?  For example, a BASE64-
> > encoded
> > SHA1-HMAC of one of the three pieces of information 
> currently suggested
> > in the
> > memo (IPv6 address, unique FQDN, UUID), where the 'secret' 
> is changed
> > for
> > every new RTP session?  This seems it could eliminate 
> traffic analysis
> > concerns.
> > 
> 
> RFC 3550 says that one of the usage of RTCP is for monitoring and "To
> facilitate third-party monitoring, the CNAME SHOULD be 
> suitable for either a program or a person to locate the source." 

Two points about that:

  o  This requirement is at odds with the need, in some RTP
     applicatoins, to thwart traffic analysis.  
  o  I find it VERY confusing to need to read both RFC3550's
     section on CNAMEs and draft-begen-avt-rtp-cnames and reach 
     some create my own Vulcan mind meld.  This is unnecessarily
     confusing.  It would be far cleaner to have one canonical
     place to read about CNAMEs.  

     So, can we pull all of the requirements and justification
     text for those requirements into draft-begen-avt-rtp-cnames,
     and have that supercede RFC3550's suggestions and
     requirements about CNAMEs?

> 
> 
> Other comments
> 
> 1. For the UUID I assume the proposal is to use the string 
> representation of the UUID maybe as a URN. 

The CNAME doesn't need the 9 characters of "urn:uuid:", though.

> 2. As for the structure of CNAME, section 6.5.1 of RFC 3550 
> has the cname
> composed of user and domain name. it also says that
> "The user name SHOULD be in a form that a program such as 
> "finger" or "talk"
> could use, i.e., it typically is the login name rather than 
> the personal
> name.  The host name is not necessarily identical to the one in the
> participant's electronic mail address. "
> Maybe this document should recommend how to create a unique 
> host part of the
> CNAME and not the whole CNAME.

I don't know how to do that, but maybe someone else does.

-d

> Regards
> Roni Even
> 
> 
> 
> _______________________________________________
> Audio/Video Transport Working Group
> avt@ietf.org
> https://www.ietf.org/mailman/listinfo/avt