Re: [MMUSIC] Bundling data channel and RTP? - Text proposal - Second try

["Schwarz, Albrecht (Albrecht)" <[e-mail]>]

Hello Christer,

wrt

> While I do realize that "connection" is not suitable for connectionless protocols, in my opinion it was a mistake to use "association", because it has caused lots of confusion. I often get questions on what the difference between a DTLS association and DTLS connection is :)

1st) There is not any contradiction between "connection" and "connectionless" (according to the basic reference model for communicaions (X.200)).
Id est, a (N)-connection is either operated in communication mode (§ 5.3.3/X.200) "connection oriented" (= "connection mode" § 5.3.3.2/X.200) or "connectionless" (§ 5.3.3.3/X.200).
=> no contradiction ("there are connectionless (N)-connections ...")

2nd) DTLS as protocol belongs to category connection-oriented, not connectionless.
The (DTLS)-connection is of type connection-oriented.


Furthermore: that's the reason why there are also "UDP connections" despite their connectionless nature.

Regards,
Albrecht


-----Original Message-----
From: mmusic [mailto:[e-mail]] On Behalf Of Christer Holmberg
Sent: Montag, 15. Juni 2015 15:07
To: GUBALLA, JENS (JENS); mmusic
Cc: [e-mail]
Subject: Re: [MMUSIC] Bundling data channel and RTP? - Text proposal - Second try

Hi Jens,

Thanks for your feeback! See inline.

>> -------------
>>
>> 12.  DTLS Considerations
>>
>>    One or more media streams within a BUNDLE group might use the
>>    Datagram Transport Layer Security (DTLS) protocol [RFC6347] in order
>>    to encrypt the data, or to negotiate encryption keys if another
>>    encryption mechanism is used to encrypt media.
>>
>>    When DTLS is used within a BUNDLE group, the following rules apply:
>>
>>    o  There can only be one DTLS association [RFC6347] associated with
>>       the BUNDLE group;
>
> [JG] I prefer the term "DTLS connection" over "DTLS association" 
> because I am not aware that the latter term is defined anywhere in the 
> scope of (D)TLS.
> RFC6347 is using the terms "connection" and "association" 
> interchangeably without any definition. On the other hand the term 
> "connection" is at least present in the glossary section of RFC5246.

RFC 5763 and RFC 5764, both related to DTLS-SRTP, use "association":


	"We use the term "association" to refer to a particular DTLS cipher
   	suite and keying material set that is associated with a single host/
   	port quartet.  The same DTLS/TLS session can be used to establish the
   	keying material for multiple associations."   (RFC 5763)


	"Each DTLS-SRTP session contains a single DTLS association (called a
	"connection" in TLS jargon),..." (RFC 5764)

While I do realize that "connection" is not suitable for connectionless protocols, in my opinion it was a mistake to use "association", because it has caused lots of confusion. I often get questions on what the difference between a DTLS association and DTLS connection is :)

>>    o  Each usage of the DTLS association within the BUNDLE group MUST
>>       use the same mechanism for determining which endpoints (the
>>       offerer or answerer) becomes DTLS client and DTLS server; and
>>
>>    o  If the DTLS client supports DTLS-SRTP [RFC5764] it MUST include
>>       the 'use_srtp' extension [RFC5764] in the DTLS ClientHello message
>>       [RFC5764], The client MUST include the extension even if the usage
>>       of DTLS-SRTP is not negotiated as part of the session.
>
> [JG] I believe here "session" is referring to "SIP session", not to 
> "DTLS session", right? Should be explicitly stated in any case.

See below.

>>    NOTE: The inclusion of the 'use_srtp' extension during the initial
>>    DTLS handshake ensures that a DTLS renegotiation will not be required
>>    in order to include the extension, in case DTLS-SRTP encrypted media
>>    is added to the BUNDLE group later during the session.
>
> [JG] "Session": Same comment as above.

It's not DTLS, but it can of course be something else than SIP.

I guess we could say something like "multimedia session", "SDP session", or something...

Regards,

Christer