Re: [MMUSIC] WGLC on draft-ietf-mmusic-dtls-sdp-06.txt

[Christer Holmberg <[e-mail]>]

Hi Martin,

...

> However, I see this:
>
>   Endpoints MUST support SHA-256 for generating and verifying the
>   fingerprint value associated with the DTLS association.  The use of
>   SHA-256 is preferred.
>
> Which doesn't mention that this requires an update of 4572.

I do agree that it would make sense to mandate support of the same ciphers for both TLS and DTLS (assuming that is the reason you think an 4572 update is needed), but I wonder whether such change is within the scope of this draft.  Having said that, though, I have no problem making such update in draft-dtls-sdp, if people think we should do it... :)

(The background to mandating support of SHA-256 was when we did RFC 7345. The security folks required it during the IESG review.)

------------------

> And this:
>
>   The certificate received during the DTLS handshake MUST match the
>   fingerprint received in the SDP "fingerprint" attribute.
>
> Which should say '*a* fingerprint', to allow for there being multiple.

Correct. In an earlier reply I told Paul I would modify the text to make sure it allows multiple attributes. This also applies to your subsequent comments on the same issue.

However, Paul is also looking for the semantics of using multiple fingerprints.

------------------

> I also see:
>
>   The subjectAltName is not an important component of the certificate
>   verification.
>
> Which is true but insufficient; the text can simply say that the certificate is only a receptacle for a public key and authentication is tied to an a=fingerprint line in the SDP.

Could you suggest the exact text change?

Thanks!

Regards,

Christer