Re: [bfcpbis] Benjamin Kaduk's No Objection on draft-ietf-bfcpbis-rfc4583bis-26: (with COMMENT)

[Christer Holmberg <[e-mail]>]

Hi,


...


>>>>> An attacker able to view the SDP exchanges can determine which media flows
>>>>> contain which content, which could exacerbate existing metadata leakage
>>>>> channels in some circumstances.
>>>>
>>>> I am not sure how that is related to the BFCP SDP negotiation?
>>>
>>> The premise here (perhaps farfetched) is that the attacker can view the SDP
>>> exchange but the actual media flows are secured with (D)TLS and not visible
>>> to the attacker.  The (D)TLS flows will leak some information via packet
>>> size/timing, perhaps allowing for traffic analysis to determine what sorts
>>> of media flows are going where.  The new attributes in the BFCP SDP
>>> negotiation can make this sort of traffic analysis more effective.  I would
>>> be fairly receptive if you wanted to say that this is not more noteworthy
>>> than for normal SDP security considerations, though.
>>
>> In general I agree with you that non-protected SDP attributes can help in traffic analysis, but the BFCP attributes only provide information
>> about the BFCP stream itself - they don't even indicate which media streams will be controlled by BFCP to begin with (that is negotiated on BFCP level).
>>
>> But, I could add something like:
>>
>> "The SDP attributes defined in this specification do not add additional security considerations to the generic security considerations for protecting
>> SDP attributes [RFC3264]. The attributes do not reveal information about the content of individual BFCP controlled media streams, nor do they reveal
>> which media streams will be BFCP controlled."
>
> That's some nicely worded text, but if you conclude that it's not adding
> enough value to justify its inclusion in the document, I'd support you on
> it.

My main point was that the attributes don't reveal information about the media content, but I have no problem to clarify that in the draft - we seldom have a problem with too much text in the Security Considerations, so... :)

Regards,

Christer




-Benjamin