Re: [clue] Comments on CaptureID and security

[Magnus Westerlund <[e-mail]>]

Hi Roni,

Den 2017-02-12 kl. 10:26, skrev Roni Even:
> Hi Magnus, About the requirement to encrypt the RTCP (do not use NULL
> security profile) I was wondering why it is not mention also on
> RTCPweb, is it because RTP/RTCP multiplexing? I think that it should
> be mentioned also there since there is option to support non
> multiplex RTP/RTCP

That is actually a shortcoming of RTCWeb Security architecture and there 
exists an tracked issue for it:

https://github.com/rtcweb-wg/security-arch/issues/34

So, yes, I would really like to see the communication security section 
mandate encrypted RTCP. This due to the information included in RTCP 
about the application. The protection profile mandated does imply equal 
strength RTCP protection, but if one uses other profiles it might not be 
as clear cut. So a wording on protecting RTCP at same or similar 
protection strength to RTP I think is motivated.

What I also think is missing in the new text is discussion of RTP header 
extension encryption, i.e. RFC 6904. I thought the conclusion on the 
capture ID is that there is no strong generation requirements to ensure 
they don't contain privacy sensitive information. And it definitely 
reveals what is happening in the application context to third parties. 
Thus, I think encrypting the RTP header extensions would be good 
practice in clue situations.

I also reacted to the use of "untraceable" in this sentence:

CLUE endpoint MUST generate short-term persistent RTCP CNAMES, as
    specified in [RFC7022], resulting in untraceable CNAME values.

The point of them is that they are not long term persistent and thus 
can't be used for long term tracking of the user. Writing "untraceable" 
I would interpret as indicating a stronger user protection then what is 
actually provided.

Magnus Westerlund

----------------------------------------------------------------------
Services, Media and Network features, Ericsson Research EAB/TXM
----------------------------------------------------------------------
Ericsson AB                 | Phone  [phone]
Färögatan 6                 | Mobile [phone]
SE-164 80 Stockholm, Sweden | mailto: [e-mail]
----------------------------------------------------------------------