[MMUSIC] Re: [TLS] Brief Cross-WG review - draft-ietf-mmusic-comedia-tls

Especially in the case where a fingerprint is present I think that the
requirements for identity matching would introduce usability problems
with no security benefit.  So I strongly argue for relaxing the
identity checking in the case where a fingerprint is available in an
integrity protected SDP exchange.

In the case where the cert is being matched against a trust anchor
through the process described in RFC 3280, the identity constraints
given in this document (or similar constraints) are absolutely
essential.

In the case where you are doing ssh-style leap of faith you do need to
decide what identity you are binding the leap of faith entry to in
your cache.  In that case the identity requirements may be helpful but
are not strict security requirements.

If you are going to support ssh-style leap of faith you do need to be
careful not to make rekeying/changing a cert harder than it needs to
be.  In particular, the user should not get a warning because there is
a leap of faith cache entry with a different certificate in it and a
valid fingerprint is presented in an integrity protected SDP session.
I'm not sure updating the cache entry would be good in that case, but
presenting a warning to the user because the cert changed would
definitely be a bad idea because it would discourage rekeying.

Now you do need to present the warning in the case where the SDP
session is not integrity protected.

--Sam

P.S. If I was too terse I can expand.

_______________________________________________
mmusic mailing list
mmusic@ietf.org
https://www1.ietf.org/mailman/listinfo/mmusic