Re: [MMUSIC] [rtcweb] BUNDLE: Attempting to resolve security consideration

Eric Rescorla <ekr@rtfm.com> Mon, 27 March 2017 14:53 UTC

Return-Path: <ekr@rtfm.com>
X-Original-To: mmusic@ietfa.amsl.com
Delivered-To: mmusic@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB870129712 for <mmusic@ietfa.amsl.com>; Mon, 27 Mar 2017 07:53:40 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.598
X-Spam-Level:
X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y-efXvQWvIGx for <mmusic@ietfa.amsl.com>; Mon, 27 Mar 2017 07:53:38 -0700 (PDT)
Received: from mail-yw0-x235.google.com (mail-yw0-x235.google.com [IPv6:2607:f8b0:4002:c05::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0DEEB1296FA for <mmusic@ietf.org>; Mon, 27 Mar 2017 07:53:38 -0700 (PDT)
Received: by mail-yw0-x235.google.com with SMTP id i203so32996800ywc.3 for <mmusic@ietf.org>; Mon, 27 Mar 2017 07:53:38 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=tB0fL/rWMok9ZxSFD3E1cZc9iz7/MIAirdLjgjyIhY4=; b=s0anfcrL//TaAKtkvq8T8/7QvrbLDEamBnq2NTT4gUPjr+k8yDhjrgNyWZ/J3dij8+ 4O2vnuhFgWVcL4yBfxOSJcEBx9mltqMWFi7Q2tVs6XSeFgDkBX5r4hvxBJne+RcxZEkt FuMPMGNT5DkJaE2qmIQ9SoudLFfZFJ123vSyyfRPSHgFt0xqWN5KUlnZC55UBrYswVLD x67IBVCm+JM/WG4ZQ44DVFxUytZ+/wPLib/XxB+v8TJSgE3YHeG1JfYASsqzfsIbcKpE u/AS+livmrkrVAL5xa0DflXvslB2exo7eKS2OX6ZXAsf9ap/n5oHP3J/xSQN8GzGHXV8 zSTw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=tB0fL/rWMok9ZxSFD3E1cZc9iz7/MIAirdLjgjyIhY4=; b=Dze9VKZbqS7+kT3Fj4VW9IIWRNAtzd4mxAv3aPHFFBJSKZNceSJfsmy7cSSJB4lrg1 jMHZWkeWPSfvJPW578f01SN6LiP/zqkY9a/IAj0JS8I/xU6m2hmEUCpYsstypwy4psQ1 6R5hkfCPvt09/wgW+OrZnwF3JuXCVoGOXc041A5O6H2Y/iKLvH/jD4uHWW0Xvb61jJTP vE7Lp3642R+5yJXEFkiiey8sSI90CkAdkvnOIMgOZcjDZha7pXvVxStG2L63qcC1mLyn n9kMMs0d2doRvSTzBNG2l501OwFUlNuj3VsZr06aqTsGxJSprqWW48q/cyD5vdEQ6kZI sZuA==
X-Gm-Message-State: AFeK/H2C1uCZWfDZno2SOBvNbWCy9ODq4HZtwuRYiptcRCph8gk5IKXL7t5gHkWv1tcmteR5jNWIlv05cydl5g==
X-Received: by 10.129.172.23 with SMTP id k23mr17674730ywh.337.1490626417246; Mon, 27 Mar 2017 07:53:37 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.129.154.210 with HTTP; Mon, 27 Mar 2017 07:52:56 -0700 (PDT)
In-Reply-To: <8743844f-3294-ec11-47d5-d642adf5fffc@ericsson.com>
References: <8b2b8754-b10c-6f8e-6262-95cd25374a18@ericsson.com> <CABcZeBMTW48fj=1EMJ3uJCdVqEiYuPk+rDy6h_7W=jh0fu7tNQ@mail.gmail.com> <0827af95-b755-9730-6605-5146967760e7@ericsson.com> <CABcZeBPcqz+NzKp=c5zZd_aDqYHjC6AhOyBMjsOdpKEjGF08qw@mail.gmail.com> <a7070e7a-81dc-ab68-c59b-d4df367029c2@ericsson.com> <CABcZeBM6LMJB2f10+F1jQNinKe4nkNGCRpT6VN1tZPXCLskxHQ@mail.gmail.com> <f390877e-d6be-11cd-8a35-f68546ae4115@ericsson.com> <CABcZeBNAU0eo+nP02LRjP3Cybtrm487wQMtq34zhmeaB+=uHiQ@mail.gmail.com> <29d1f31b-402c-5f31-8eee-f1f066ddce29@ericsson.com> <CABcZeBP_c90N+bWiQXTg8-VvwY4Vme1T0v88DQ4DSW_KnG_Cuw@mail.gmail.com> <314d5af9-018d-8d15-7629-dbcc62fe5a2e@ericsson.com> <8743844f-3294-ec11-47d5-d642adf5fffc@ericsson.com>
From: Eric Rescorla <ekr@rtfm.com>
Date: Mon, 27 Mar 2017 09:52:56 -0500
Message-ID: <CABcZeBPiexFiho7A5pVDt4zu9n3K1sY9+HMCcqUd+FBgF8Hb=g@mail.gmail.com>
To: Magnus Westerlund <magnus.westerlund@ericsson.com>
Cc: "rtcweb@ietf.org" <rtcweb@ietf.org>, "mmusic (E-mail)" <mmusic@ietf.org>
Content-Type: multipart/alternative; boundary=94eb2c1bae0017f3d7054bb7829b
Archived-At: <https://mailarchive.ietf.org/arch/msg/mmusic/IIWNU2Df-casoG0cFUFSet8Zs6c>
Subject: Re: [MMUSIC] [rtcweb] BUNDLE: Attempting to resolve security consideration
X-BeenThere: mmusic@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Multiparty Multimedia Session Control Working Group <mmusic.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mmusic>, <mailto:mmusic-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mmusic/>
List-Post: <mailto:mmusic@ietf.org>
List-Help: <mailto:mmusic-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mmusic>, <mailto:mmusic-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 27 Mar 2017 14:53:41 -0000

On Sun, Mar 26, 2017 at 1:41 PM, Magnus Westerlund <
magnus.westerlund@ericsson.com> wrote:

> Hi,
>
> I have attempted to address the issue discussed below by reformulating
> that paragraph to read:
>
>    When the BUNDLE extension is used, the set of configurations of the
>    security mechanism used in all the bundled media descriptions will
>    need to be compatible for simultaneously use, at least per direction
>    or endpoint.


I'm not sure I understand what "compatible for simultaneously use" means.

-Ekr

When using SRTP this will be the case, at least for the
>    IETF defined key-management solutions due to their SDP attributes
>    (a=crypto, a=fingerprint, a=mikey) and their classification in
>    [I-D.ietf-mmusic-sdp-mux-attributes].
>
>
> So, does this work?
>
> Cheers
>
> Magnus
>
>
>
> Den 2017-03-14 kl. 03:47, skrev Magnus Westerlund:
>
>> Den 2017-03-10 kl. 16:31, skrev Eric Rescorla:
>>
>>>
>>>        When the BUNDLE extension is used, a single set of security
>>>        credentials over the bundled media descriptions will need to be
>>> used,
>>>        at least per direction or endpoint.
>>>
>>>
>>> Actually, why does this have to be the case? I mean, we require it, but
>>> if you have the MID extension, you could easily not do this.
>>>
>>>
>> You are correct, this is actually misstating the problem. It is not the
>> security credentials that need to be a single set. Any SDP level
>> security configuration used on individual media description MUST be
>> possible to use when creating a bundle group across the full or a
>> sub-set of the media description offered as a bundle group.
>>
>> This works fine for the below listed ones by following the limiations
>> indicated in SDP MUX attributes, i.e. transport or identical. But for a
>> future mechanism that is defined with bundle in mind from the start
>> could have individual configurations.
>>
>>
>>>
>>>     When using SRTP this will be the
>>>        case, at least for the IETF defined key-management solutions
>>> due to
>>>        their SDP attributes (a=crypto, a=fingerprint, a=mikey) and their
>>>        classification in [I-D.ietf-mmusic-sdp-mux-attributes].
>>>
>>>
>> I will have to think on how to re-write this.
>>
>> Cheers
>>
>> Magnus Westerlund
>>
>> ----------------------------------------------------------------------
>> Media Technologies, Ericsson Research
>> ----------------------------------------------------------------------
>> Ericsson AB                 | Phone  +46 10 7148287
>> Färögatan 6                 | Mobile +46 73 0949079
>> SE-164 80 Stockholm, Sweden | mailto: magnus.westerlund@ericsson.com
>> ----------------------------------------------------------------------
>>
>> _______________________________________________
>> rtcweb mailing list
>> rtcweb@ietf.org
>> https://www.ietf.org/mailman/listinfo/rtcweb
>>
>
>
> --
>
> Magnus Westerlund
>
> ----------------------------------------------------------------------
> Media Technologies, Ericsson Research
> ----------------------------------------------------------------------
> Ericsson AB                 | Phone  +46 10 7148287
> Färögatan 6                 | Mobile +46 73 0949079
> SE-164 80 Stockholm, Sweden | mailto: magnus.westerlund@ericsson.com
> ----------------------------------------------------------------------
>
>