Re: [MMUSIC] BUNDLE - MID Security - Updated text proposal

[Cullen Jennings <[e-mail]>]

Yes that seems like a good path. I'd also like to give any reasonable advice we can on creating MIDs such that they meet that goal.  Is there any reason not to just make MID a 16 bit integer ? same for RID ?


> On Nov 2, 2016, at 3:36 AM, Magnus Westerlund <[e-mail]> wrote:
> 
> Hi,
> 
> I didn't receive any feedback. Below you will find a further updated text proposal attempting to be non-controversial. If you find the below erroneous or problematic, I do need you to speak up, because then I don't understand your issue:
> 
> 
> ---- Text Proposal ----
> 
> The identfication-tag when included in the RTP MID SDES item, independent of transport, RTCP SDES packet or RTP header extension, can expose the value to parties beyond the signaling chain. Therefore, the identification-tag MUST NOT contain any user related information for privacy reasons, nor hardware based identifiers. That as such information could enable tracking of the sending end point.
> 
> The identification-tag is used to route the media stream to the right application functionality, thus is important that the value received is the one intended by the sender. Malicious modifications can result in that a media stream is wrongly attributed or fails to be played. Thus, verifying integrity and the authenticity of the source are RECOMMENDED to prevent these attacks on the application. Security mechanisms for RTP/RTCP are discussed in Options for Securing RTP Sessions [RFC7201].
> 
> ---- End of Text Proposal ----
> 
> There has been discussion if the MID identification-tag should have a proposed or mandated construction pattern. I think there are benefits to that. Using the same ASCII based pattern that RID suggest is fine, however I think it can clarify which character in the range above dec 48 ("0") in the ASCII table should be used, and if one have more tags than what fits a single character, what one would do in that case.
> 
> Cheers
> 
> Magnus Westerlund
> 
> ----------------------------------------------------------------------
> Services, Media and Network features, Ericsson Research EAB/TXM
> ----------------------------------------------------------------------
> Ericsson AB                 | Phone  [phone]
> Färögatan 6                 | Mobile [phone]
> SE-164 80 Stockholm, Sweden | mailto: [e-mail]
> ----------------------------------------------------------------------
>