Re: [MMUSIC] 10 BUNDLE questions: Same SDES key for multiple m- lines?

[Martin Thomson <[e-mail]>]

On 30 April 2013 05:16, Christer Holmberg
<[e-mail]> wrote:
> Regarding using the same SDES key, it is important to remember that, if there is a fallback (ie the remote endpoint does not support BUNDLE, and the SDP answer will contain different ports), there will be different RTP sessions, in which case two-time pad becomes an issue.

Yes, I hadn't considered that, but it's another reason to have
different keys :)  Since this is only the bundling side that is
affected, this can be addressed with a security considerations note to
the effect that the bundler, who has chosen to use the same key across
m= lines, MUST NOT select the same SSRC for those sessions.  I think
that's an easy thing to do.

Still, even without special measures chances are that you wont pick
colliding SSRCs.  Though the odds are not really in your favor given
the size of the space you chose from; it doesn't take many sessions
before it happens to someone.

> So, one way forward would be:
>
> 1. In the first offer, when it is still unknown whether the remote endpoint supports BUNDLE, use different SDES keys.
>
> 2. In the second offer, if the remote endpoint indicated support of BUNDLE, allow switching to a single SDES key.

That would be reasonable too.  I probably wouldn't bother with the
change in practice (see above), but MAY == good.