Re: [MMUSIC] Review of draft-ietf-mmusic-sdp-bundle-negotiation-32 - Magnus' comments - MID security

[Magnus Westerlund <[e-mail]>]

Den 2016-10-07 kl. 20:33, skrev Eric Rescorla:
> ISTM that there are two risks:
> 1. That people might use structured RIDs, MIDs, etc. and that that will
> leak a lot of information about
> 2. That just the structure of the media streams is a fingerprinting risk.
>
> The first of these seems addressable by guidance about how to construct
> these IDs. I note that we
> have only very limited guidance on how to construct ICE
> ufrag/passwords....

So, the difference here from stuff that normally exists in SDP is that 
it goes in many RTP packets in the clear compared to only over the 
signaling path. The ICE ufrag is in that sense equivalent as that is 
also sent in the clear and in all ICE connectivity checks.


The second seems
> not that interesting as I bet you can get a lot by other metadata
> (packet size, PT, etc).

Well, yes there are some other leakages. However, we don't need to 
increase the exposure, just because there are shortcomings today.

So lets review what the current proposal is:

1. Bundle RECOMMENDS encryption of the MID values, do you think that is 
unnecessary? Should we have no recommendation about confidentiality 
protection at all?

2. The above point is not relevant in a WebRTC perspective. In WebRTC we 
already have mandated encryption of RTCP. Thus, RFC 7904 mandates that 
we also encrypt the MID RTP header extension. Thus, for WebRTC we 
already have a result, that is not possible to change without revising 
RFC 7904 and argue that the conclusion there is wrong, which I don't 
think it is. If we protect information RTCP, it should be protected also 
in RTP headers.

So, anything you like to change here?

Cheers

Magnus Westerlund

----------------------------------------------------------------------
Services, Media and Network features, Ericsson Research EAB/TXM
----------------------------------------------------------------------
Ericsson AB                 | Phone  [phone]
Färögatan 6                 | Mobile [phone]
SE-164 80 Stockholm, Sweden | mailto: [e-mail]
----------------------------------------------------------------------