Re: [MMUSIC] WGLC on draft-ietf-mmusic-dtls-sdp-06.txt

[Roman Shpount <[e-mail]>]

On Wed, Feb 24, 2016 at 3:36 PM, Paul Kyzivat <[e-mail]> wrote:

> Can you (as the author of RFC4572) explain the use of multiple
> fingerprints? The dtls-sdp draft talks about the possibility of multiple
> fingerprints, but I can find no explanation of the semantics of that.
>

I think the original explanation was that TLS (or DTLS) session is
terminated if none of the fingerprints matched. In other words, at least
one fingerprint MUSt match for the session to be established,

One of the use cases is when RTP and RTCP DTLS flows are using different
certificates. In this case two fingerprint attributes will be added to SDP
m= line. When separate DTLS associations are established for RTP and RTCP,
each of these association will match one of the fingerprints and fail to
match the other.

Another use case is to generate an offer that will work with remote end
points that support different certificate signature algorithms. For
instance when transitioning from SHA-1 to SHA-256 two certificates would be
created by the origination end point and fingerprints for both will be
included. When DTLS association is negotiated, it will establish which
certificate signature algorithm is supported by both parties and use the
appropriate certificate. Once again, only one of the fingerprints will
match.
_____________
Roman Shpount