Re: [MMUSIC] WGLC on draft-ietf-mmusic-dtls-sdp-06.txt

[Paul Kyzivat <[e-mail]>]

Jonathan,

Can you (as the author of RFC4572) explain the use of multiple 
fingerprints? The dtls-sdp draft talks about the possibility of multiple 
fingerprints, but I can find no explanation of the semantics of that.

	Thanks,
	Paul

On 2/24/16 3:26 PM, Christer Holmberg wrote:

>>>> * Section 5.1:
>>>>
>>>>      The certificate received during the DTLS handshake MUST match the
>>>>      fingerprint received in the SDP "fingerprint" attribute.  If the
>>>>      fingerprint does not match the hashed certificate, then the endpoint
>>>>      MUST tear down the media session immediately.  ...
>>>>
>>>> This talks about *the* fingerprint. But, IIUC, multiple fingerprints may be supplied. What is the required processing in that case?
>>>
>>> We try to clarify that in section 3.4, which says:
>>>
>>>      "It is possible to associate multiple SDP fingerprint attribute values
>>>      to an 'm-' line.  If any of the attribute values associated with an
>>>      'm-' line are removed, or if any new attribute values are added, it
>>>      is considered a fingerprint value change."
>>
>> Right. But AFAIK that is the only place it is mentioned. At the least, most places that reference "the fingerprint"
>> should acknowledge that there may be more than one.
>
> I guess we could use "one or more SDP 'fingerprint' attributes" terminology instead of "an SDP 'fingerprint' attribute".
>
>> And *someplace* needs to say what the semantics of use are when there is more than one. (Maybe it is defined in one
>> of the references?) Am I correct in assuming that providing multiple fingerprints is for the convenience of the
>> recipient, who can then pick the one that it prefers to verify?
>
> I don't think the semantics are defined anywhere, unless it is defined in some RTCWEB document... I remember that it was agreed at some point that multiple fingerprints were allowed, but I am not sure whether anything was written down in a specificaiton...
>
> In my opinion, the semantics belong to RFC 4572.