Re: [MMUSIC] [rtcweb] BUNDLE: Attempting to resolve security consideration

Magnus Westerlund <magnus.westerlund@ericsson.com> Mon, 27 March 2017 14:21 UTC

Return-Path: <magnus.westerlund@ericsson.com>
X-Original-To: mmusic@ietfa.amsl.com
Delivered-To: mmusic@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2E7C0129557; Mon, 27 Mar 2017 07:21:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.22
X-Spam-Level:
X-Spam-Status: No, score=-4.22 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kCteSpZzhYjR; Mon, 27 Mar 2017 07:20:59 -0700 (PDT)
Received: from sesbmg23.ericsson.net (sesbmg23.ericsson.net [193.180.251.37]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C489412942F; Mon, 27 Mar 2017 07:20:58 -0700 (PDT)
X-AuditID: c1b4fb25-ccfff70000002d78-01-58d91fc83a6b
Received: from ESESSHC018.ericsson.se (Unknown_Domain [153.88.183.72]) by (Symantec Mail Security) with SMTP id AA.BC.11640.8CF19D85; Mon, 27 Mar 2017 16:20:57 +0200 (CEST)
Received: from [127.0.0.1] (153.88.183.153) by smtp.internal.ericsson.com (153.88.183.74) with Microsoft SMTP Server id 14.3.339.0; Mon, 27 Mar 2017 16:20:55 +0200
To: Eric Rescorla <ekr@rtfm.com>
References: <8b2b8754-b10c-6f8e-6262-95cd25374a18@ericsson.com> <CABcZeBMTW48fj=1EMJ3uJCdVqEiYuPk+rDy6h_7W=jh0fu7tNQ@mail.gmail.com> <0827af95-b755-9730-6605-5146967760e7@ericsson.com> <CABcZeBPcqz+NzKp=c5zZd_aDqYHjC6AhOyBMjsOdpKEjGF08qw@mail.gmail.com> <a7070e7a-81dc-ab68-c59b-d4df367029c2@ericsson.com> <CABcZeBM6LMJB2f10+F1jQNinKe4nkNGCRpT6VN1tZPXCLskxHQ@mail.gmail.com> <f390877e-d6be-11cd-8a35-f68546ae4115@ericsson.com> <CABcZeBNAU0eo+nP02LRjP3Cybtrm487wQMtq34zhmeaB+=uHiQ@mail.gmail.com> <29d1f31b-402c-5f31-8eee-f1f066ddce29@ericsson.com> <CABcZeBP_c90N+bWiQXTg8-VvwY4Vme1T0v88DQ4DSW_KnG_Cuw@mail.gmail.com> <314d5af9-018d-8d15-7629-dbcc62fe5a2e@ericsson.com> <8743844f-3294-ec11-47d5-d642adf5fffc@ericsson.com>
CC: "rtcweb@ietf.org" <rtcweb@ietf.org>, "mmusic (E-mail)" <mmusic@ietf.org>
From: Magnus Westerlund <magnus.westerlund@ericsson.com>
Message-ID: <31bdea76-61b2-9c8f-78ff-0936c4bc2d13@ericsson.com>
Date: Mon, 27 Mar 2017 09:20:52 -0500
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0
MIME-Version: 1.0
In-Reply-To: <8743844f-3294-ec11-47d5-d642adf5fffc@ericsson.com>
Content-Type: text/plain; charset="utf-8"; format=flowed
Content-Transfer-Encoding: 8bit
X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrNLMWRmVeSWpSXmKPExsUyM2K7h+5J+ZsRBueW8luseH2O3WLq8scs Fmv/tbM7MHssWfKTyWPy4zbmAKYoLpuU1JzMstQifbsEroy7+5YyFXySqli/4ihLA+MG0S5G Tg4JAROJx90PmbsYuTiEBNYzSpzpO8YC4SxnlLg4ZxMzSJWwQKhE06QeMFtEQEHi158TUEXP WCV2r7/GCJJgFvCRuLJhFTuIzSZgIXHzRyMbiM0rYC+x9NMtMJtFQFVictNVsBpRgRiJliUf GCFqBCVOznzCAmJzCjhITDt0iA1ipoXEzPnnoebLSzRvnQ12hJCAtkRDUwfrBEaBWUjaZyFp mYWkZQEj8ypG0eLU4qTcdCNjvdSizOTi4vw8vbzUkk2MwCA9uOW36g7Gy28cDzEKcDAq8fA+ kLoZIcSaWFZcmXuIUYKDWUmE9xs3UIg3JbGyKrUoP76oNCe1+BCjNAeLkjiv474LEUIC6Ykl qdmpqQWpRTBZJg5OqQZG+4a+s+vltp39+NVaRfDZyaDLGy/Ha3+/smvFYeZeMbUrbZVKLgLH m/mWsa8QClK/I2YvtKlX97WUpbiKAXuaeuS/KXMWvHP58/jFlaY97VKqtyRSJE7XRDjcfCLQ 3ZFpdkmky7Y+Rk44/9jmDbPu8O759eTskrNOWxJi2oLOaK3pN007PP2hEktxRqKhFnNRcSIA 7FaW404CAAA=
Archived-At: <https://mailarchive.ietf.org/arch/msg/mmusic/_6Zfpi2LhQNE07hl9HXq6623oCY>
Subject: Re: [MMUSIC] [rtcweb] BUNDLE: Attempting to resolve security consideration
X-BeenThere: mmusic@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Multiparty Multimedia Session Control Working Group <mmusic.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/mmusic>, <mailto:mmusic-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/mmusic/>
List-Post: <mailto:mmusic@ietf.org>
List-Help: <mailto:mmusic-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/mmusic>, <mailto:mmusic-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 27 Mar 2017 14:21:01 -0000

Hi,

I have created a PR for the proposed update of the security 
consideration text.

https://github.com/cdh4u/draft-sdp-bundle/pull/30

Cheers

Magnus


Den 2017-03-26 kl. 13:41, skrev Magnus Westerlund:
> Hi,
>
> I have attempted to address the issue discussed below by reformulating
> that paragraph to read:
>
>    When the BUNDLE extension is used, the set of configurations of the
>    security mechanism used in all the bundled media descriptions will
>    need to be compatible for simultaneously use, at least per direction
>    or endpoint.  When using SRTP this will be the case, at least for the
>    IETF defined key-management solutions due to their SDP attributes
>    (a=crypto, a=fingerprint, a=mikey) and their classification in
>    [I-D.ietf-mmusic-sdp-mux-attributes].
>
>
> So, does this work?
>
> Cheers
>
> Magnus
>
>
> Den 2017-03-14 kl. 03:47, skrev Magnus Westerlund:
>> Den 2017-03-10 kl. 16:31, skrev Eric Rescorla:
>>>
>>>        When the BUNDLE extension is used, a single set of security
>>>        credentials over the bundled media descriptions will need to be
>>> used,
>>>        at least per direction or endpoint.
>>>
>>>
>>> Actually, why does this have to be the case? I mean, we require it, but
>>> if you have the MID extension, you could easily not do this.
>>>
>>
>> You are correct, this is actually misstating the problem. It is not the
>> security credentials that need to be a single set. Any SDP level
>> security configuration used on individual media description MUST be
>> possible to use when creating a bundle group across the full or a
>> sub-set of the media description offered as a bundle group.
>>
>> This works fine for the below listed ones by following the limiations
>> indicated in SDP MUX attributes, i.e. transport or identical. But for a
>> future mechanism that is defined with bundle in mind from the start
>> could have individual configurations.
>>
>>>
>>>
>>>     When using SRTP this will be the
>>>        case, at least for the IETF defined key-management solutions
>>> due to
>>>        their SDP attributes (a=crypto, a=fingerprint, a=mikey) and their
>>>        classification in [I-D.ietf-mmusic-sdp-mux-attributes].
>>>
>>
>> I will have to think on how to re-write this.
>>
>> Cheers
>>
>> Magnus Westerlund
>>
>> ----------------------------------------------------------------------
>> Media Technologies, Ericsson Research
>> ----------------------------------------------------------------------
>> Ericsson AB                 | Phone  +46 10 7148287
>> Färögatan 6                 | Mobile +46 73 0949079
>> SE-164 80 Stockholm, Sweden | mailto: magnus.westerlund@ericsson.com
>> ----------------------------------------------------------------------
>>
>> _______________________________________________
>> rtcweb mailing list
>> rtcweb@ietf.org
>> https://www.ietf.org/mailman/listinfo/rtcweb
>
>


-- 

Magnus Westerlund

----------------------------------------------------------------------
Media Technologies, Ericsson Research
----------------------------------------------------------------------
Ericsson AB                 | Phone  +46 10 7148287
Färögatan 6                 | Mobile +46 73 0949079
SE-164 80 Stockholm, Sweden | mailto: magnus.westerlund@ericsson.com
----------------------------------------------------------------------