Re: [MMUSIC] Draft new version: draft-holmberg-mmusic-sdp-dtls-01

[Christer Holmberg <[e-mail]>]

Hi Sal,

Unless you change the transport parameters, you may receive DTLS packets associated with the old and new DTLS association on the same address:port.

Regards,

Christer

Sent from my Windows Phone
________________________________
From: Salvatore Loreto<mailto:[e-mail]>
Sent: ‎22/‎06/‎2015 12:51
To: Christer Holmberg<mailto:[e-mail]>; Martin Thomson<mailto:[e-mail]>
Cc: Paul Kyzivat<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Subject: Re: [MMUSIC] Draft new version: draft-holmberg-mmusic-sdp-dtls-01


> On 21 Jun 2015, at 01:05, Christer Holmberg <[e-mail]> wrote:
>
> Hi Paul,
>
> Thanks for your comments. See inline.
>
>
>> * Section 2.1:
>>
>>   When a new DTLS association is established, an endpoint MUST use a
>>   new set of transport parameters (IP address and port combination).
>>
>> The above seems slightly ambiguous: does "an endpoint" mean "each endpoint" or "one (of the two) endpoints"?
>>
>> IIUC we have established that the important point is that the 5-tuple must change. So at least one side must change the address or port. But if one > side is known to do so, then the other side need not do so. So I suggest changing the above to:
>>
>>   When a new DTLS association is established, one of the endpoints
>>   MUST use a new set of transport parameters (IP address and port
>>   combination).
>
> The idea is that the endpoint(s) which does something the requires a new set of transport parameters needs to use a new set.
>
> So, if e.g. endpoint A wants to change the fingerprint, which requires a new DTLS association, endpoint A needs to use a new set of transport parameters.

I agree that
If you change the certificate you intend to use, then you need a new DTLS association

however I am not sure that this (i.e. the change of the certificate) also implies the endpoint has to use necessary a new set of transport parameters.

Can you someone clarify this to me?

thanks
/Sal