Re: [MMUSIC] Draft new version: draft-ietf-mmusic-dtls-sdp-09

[Paul Kyzivat <[e-mail]>]

On 3/1/16 3:55 PM, Roman Shpount wrote:

> When there is a new association, new DTLS handshake occurs. During this
> handshake, capabilities and then certificates are exchanged. Certificate
> received from the remote party is checked against the list of
> fingerprints. If a fingerprint matching the certificate is found, then
> connection is accepted. If no matching fingerprint is found, connection
> MUST be torn down.

What is unclear (to me) is how to deal with multiple fingerprints. And, 
IIUC, there can also be multiple certificates.

As it used to be, the crypto used on the fingerprint had to match that 
on the certificate. So if you could handle the certificate you could 
handle the fingerprint. I gather that there is now a request to break 
that linkage. So the fingerprint might use a different crypto than the 
cert if signs.

So, am I to choose all the certs I can decode and try to verify them 
with all the fingerprint I can?

What are the criteria for success? One fingerprint verifying one cert?

	Thanks,
	Paul