Re: [AVT] Re: Comments on draft-ietf-avt-rtp-vc1-02

[[e-mail]]

MPEG-2 user data can contain any byte stream, and it's entierly up to the
receiver what to do with it (i.e. throwing it away, executing it, ...). 
Acyive content is allowed in MPEG-2 user data.

I'm unaware of any use of MPEG-2 user data in a way that would warrant the
term "active content", though.  User data has been used for mechanisms
such as close captioning, key transmission, and non-compliant vendor
specific standard enhancements.  The most important application in use (as
far as I know) is operator differentiation: a box purchased from operator
x will not work in the network of operator y.

Regards,
Stephan


> Anders Klemets wrote:
>>>>>T1. Will it be possible to carry any type of active content (like
>>>>>scripts or Java code) in the VC-1 user data? If that is the case
>>
>> there
>>
>>>Yes, sorry, I meant RFC 3640 that contains such paragraphs in its
>>>security consideration section.
>>
>>
>> I can understand that RFC 3640 needs to discuss security, because
>> MPEG-J, BIFS, etc., are part of the MPEG-4 spec itself.  The VC-1
>> user-data, on the other hand, is registered separately by SMPTE.
>>
>> VC-1 user-data is actually identical to the MPEG-2 user-data.  And RFC
>> 2250 (MPEG-2 RTP Payload Format) doesn't mention user-data as a security
>> risk.
>
> Okay, does MPEG-2 user data allow scripting or other active content? If
> that is the case I would like to have warning about also that, similar
> to the last paragraph in section 5 of RFC 3640.
>
> That RFC 2250 lacks this is of course not good, but hardly surprising.
> We have gather quite a lot of experience since 1998. Also we are raising
> the bar for our standard tracks RTP payload formats in all regards.
>
>>
>> In my opinion, putting a warning about user-data is a little bit like
>> putting a warning against downloading binaries in the HTTP spec, or
>> putting a warning about telemarketer scams in the SIP spec. :-)
>>
>> Nevertheless, I have written the following paragraph, to be added to the
>> VC-1 security considerations section:
>>
>> "VC-1 bit streams can carry user-data, such as closed captioning
>> information and content meta-data.  VC-1 requires identifiers for
>> user-data to be registered with SMPTE.  Depending on the type of
>> user-data, it might be possible for a sender to generate user-data in a
>> non-compliant manner to crash the receiver or make it temporarily
>> unavailable.  Senders that transport VC-1 bit streams SHOULD ensure that
>> the user-data is compliant with the specification registered with SMPTE
>> (see Annex F of [1].)  Receivers should prevent malfunction in case of
>> non-compliant user-data."
>>
>> Does it look OK?
>
> I think you should use upper case SHOULD also in the last sentence. In
> addition we need to know if MPEG2 user data may contain active content
> to determine if also that needs to be included.
>
> Cheers
>
> Magnus Westerlund
>
> Multimedia Technologies, Ericsson Research EAB/TVA/A
> ----------------------------------------------------------------------
> Ericsson AB                | Phone [phone]
> Torshamsgatan 23           | Fax   [phone]
> S-164 80 Stockholm, Sweden | mailto: [e-mail]
>
> _______________________________________________
> Audio/Video Transport Working Group
> [e-mail]
> https://www1.ietf.org/mailman/listinfo/avt
>



_______________________________________________
Audio/Video Transport Working Group
[e-mail]
https://www1.ietf.org/mailman/listinfo/avt