[MMUSIC] FW: Mixing Session Level and Media Level a=key-mgmt:mikey lines

Repost on behalf of Guylain Lavoie to mmusic since no answer received yet in msec mailing list.

Thanks,

Pascal.D

________________________________

From: msec-bounces@securemulticast.org [mailto:msec-bounces@securemulticast.org] On Behalf Of Christian Beaulieu
Sent: 17 février 2006 09:07
To: msec@securemulticast.org
Subject: [MSEC] Mixing Session Level and Media Level a=key-mgmt:mikey lines

From: Guylain Lavoie 

Hi everyone,

I have two questions related to the utilization of MIKEY with SDP.

As stated in draft-ietf-mmusic-kmgmt-ext-15.txt, a single SRTP media stream generates two MIKEY crypto sessions. The first is outgoing and includes the locally known outgoing SSRC and ROC. The second is incoming and includes zeroed SSRC and ROC since they are not known. The MIKEY responder will later provide them in its MIKEY response.

Now that being said, if a=key-mgmt:mikey line is located at the session level and there are two m= lines, the session level MIKEY exchange will contain four crypto sessions. Two for each of the SRTP streams. Here is the example.

   v=0

   o=alice 2891092738 2891092738 IN IP4 w-land.example.com

   s=Cool stuff

   e=alice@w-land.example.com

   t=0 0

   c=IN IP4 w-land.example.com

   a=key-mgmt:mikey AQAFgM0XflABZZZZZZZZZZZZZZZZZAy... <== 4 CS

   m=audio 49000 RTP/SAVP 98

   a=rtpmap:98 AMR/8000

   m=video 52230 RTP/AVP 31

   a=rtpmap:31 H261/90000

draft-ietf-mmusic-kmgmt-ext-15.txt also states that if a key-mgmt attribute exists at the media level, the session level attribute MUST be ignored.

Now, this puzzles me. If we reuse the previous example but with a single modification. If one of the media level also contains a a=key-mgmt:mikey line. How many crypto sessions will now be created within the session level MIKEY initiate message? Four or Two? Four for both media lines even if the first one also contains a a=key-mgmt:mikey line or two, only for the second media line.

For example,

   v=0

   o=alice 2891092738 2891092738 IN IP4 w-land.example.com

   s=Cool stuff

   e=alice@w-land.example.com

   t=0 0

   c=IN IP4 w-land.example.com

   a=key-mgmt:mikey AQAFgM0XflABZZZZZZZZZZZZZZZZZAy... <== 4 or 2 CS?

   m=audio 49000 RTP/SAVP 98

   a=rtpmap:98 AMR/8000

   a=key-mgmt:mikey AQAFgM0XflABAAAAAAAAAAAAAAsAy... <== 2 CS

   m=video 52230 RTP/AVP 31

   a=rtpmap:31 H261/90000

My second question is "What should we do if the media level MIKEY exchange fails while the session level MIKE exchanges is successful?". draft-ietf-mmusic-kmgmt-ext-15.txt says that the session level must be ignored. I assume that if the media level MIKEY exchange fails, then there will be no automatic fallback to the session level MIKEY exchange event if the answer to the first question is four. If the answer was two, then it becomes obvious that there is no fallback. I would expect that no fallback is possible (in all cases).

Best Regards,

Guylain Lavoie

[MMUSIC] FW: Mixing Session Level and Media Level a=key-mgmt:mikey lines

Attachment: ATT521743.txt