Re: [dispatch] Fwd: I-D Action: draft-johnston-dispatch-osrtp-00.txt

This seems like a good idea.

I have three comments:

1. You should forbid the answerer from sending back two types of
keying parameters (e.g., a=crypto and a=fingerprint) because that creates
confusion.

2. You probably shouldn't relax the need to send SDES over HTTPS because
the security properties there are still fairly bad.

3. I would suggest that failure to negotiate a secure channel (for DTLS-SRTP
and ZRTP) should lead to media failure not falling back. There's basically
no good reason for this to fail and it seems like it will make diagnosing
issues easier.

-Ekr

On Wed, Jul 8, 2015 at 9:17 AM, Alan Johnston <alan.b.johnston@gmail.com>
wrote:

> Hi Martin,
>
> It is the version of the draft that is actually implemented and used.
> There are also a few slight differences due to the way that Opportunistic
> Security is defined.
>
> - Alan -
>
> On Wed, Jul 8, 2015 at 11:14 AM, Martin Thomson <martin.thomson@gmail.com>
> wrote:
>
>> How does this differ from:
>> https://tools.ietf.org/html/draft-kaplan-mmusic-best-effort-srtp-01
>>
>> On 8 July 2015 at 04:02, Alan Johnston <alan.b.johnston@gmail.com> wrote:
>> > All,
>> >
>> > Many of us have been talking about "Best Effort SRTP" for many years,
>> and
>> > there are a number of deployments.  In addition, the IMTC has
>> recommended
>> > it, and the SIP Forum would like to recommend it in SIPconnect 2.0
>> which for
>> > the first time includes SRTP media.  With the publication of RFC 7435
>> > (https://tools.ietf.org/html/rfc7435) the IETF has endorsed this
>> approach
>> > as Opportunistic Security (OS), so it would be nice to bring standards
>> in
>> > line with industry practice.
>> >
>> > Comments on the draft, "An Opportunistic Approach for Secure Real-time
>> > Transport Protocol (OSRTP)" and the best way forward are most welcome!
>> >
>> > - Alan -
>> >
>> > ---------- Forwarded message ----------
>> > From: <internet-drafts@ietf.org>
>> > Date: Mon, Jul 6, 2015 at 1:48 PM
>> > Subject: I-D Action: draft-johnston-dispatch-osrtp-00.txt
>> > To: i-d-announce@ietf.org
>> >
>> >
>> >
>> > A New Internet-Draft is available from the on-line Internet-Drafts
>> > directories.
>> >
>> >
>> >         Title           : An Opportunistic Approach for Secure Real-time
>> > Transport Protocol (OSRTP)
>> >         Authors         : Alan Johnston
>> >                           Bernard Aboba
>> >                           Andy Hutton
>> >                           Laura Liess
>> >                           Thomas Stach
>> >         Filename        : draft-johnston-dispatch-osrtp-00.txt
>> >         Pages           : 8
>> >         Date            : 2015-07-06
>> >
>> > Abstract:
>> >    Opportunistic Secure Real-time Transport Protocol (OSRTP) allows
>> >    encrypted media to be used in environments where support for
>> >    encryption is not known in advance, and not required.  OSRTP is an
>> >    implementation of Opportunistic Security, as defined in RFC 7435.
>> >    OSRTP does not require advanced SDP extensions or features and is
>> >    fully backwards compatible with existing secure and insecure
>> >    implementations.  OSRTP is not specific to any key management
>> >    technique for SRTP.
>> >
>> >
>> > The IETF datatracker status page for this draft is:
>> > https://datatracker.ietf.org/doc/draft-johnston-dispatch-osrtp/
>> >
>> > There's also a htmlized version available at:
>> > https://tools.ietf.org/html/draft-johnston-dispatch-osrtp-00
>> >
>> >
>> > Please note that it may take a couple of minutes from the time of
>> submission
>> > until the htmlized version and diff are available at tools.ietf.org.
>> >
>> > Internet-Drafts are also available by anonymous FTP at:
>> > ftp://ftp.ietf.org/internet-drafts/
>> >
>> > _______________________________________________
>> > I-D-Announce mailing list
>> > I-D-Announce@ietf.org
>> > https://www.ietf.org/mailman/listinfo/i-d-announce
>> > Internet-Draft directories: http://www.ietf.org/shadow.html
>> > or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>> >
>> >
>> > _______________________________________________
>> > dispatch mailing list
>> > dispatch@ietf.org
>> > https://www.ietf.org/mailman/listinfo/dispatch
>> >
>>
>
>
> _______________________________________________
> dispatch mailing list
> dispatch@ietf.org
> https://www.ietf.org/mailman/listinfo/dispatch
>
>