Re: [MMUSIC] Updates to BUNDLE "Security Considerations"

[Suhas Nandakumar <[e-mail]>]

Hello Christer

  That's right - first in the a=group:BUNDLE list.

Thanks
Suhas

On Tue, Nov 22, 2016 at 1:56 PM, Christer Holmberg <
[e-mail]> wrote:

> Hi,
>
> When you say “put the m-line first” I assume you mean first in the
> group:BUNDLE attribute list?
>
> Regards,
>
> Christer
>
> From: Suhas Nandakumar <[e-mail]>
> Date: Tuesday 22 November 2016 at 11:20
> To: "[e-mail]" <
> [e-mail]>
> Cc: "[e-mail]" <[e-mail]>
> Subject: Updates to BUNDLE "Security Considerations"
> Resent-From: <[e-mail]>
> Resent-To: Christer Holmberg <[e-mail]>, Harald
> Alvestrand <[e-mail]>, Cullen Jennings <[e-mail]>
> Resent-Date: Tuesday 22 November 2016 at 11:20
>
> Hello Bundle Authors
>
>    As part of discussions on the Stephen Farrell's "COMMENT" on the SDP
> Mux Draft during IESG Evaluation, there was a  proposal made to update the
> Security Considerations section of the BUNDLE draft to address security
> concern raised by Stephen.
>
> The issue:
>    When using a=crypto (TRANSPORT category) attribute across media
> sections, the Offer/Answer negotiation MAY end up in selecting a media
> section with a weaker a=crypto line.
>
> The Proposal (from Cullen):
>
>  So here my straw man suggestion ... it seems like the right place to
> > mention this is in the security consideration for bundle and point
> > out that if you offer multiple m-lines that are bundled, the
> > recommendation is for the offers and answers to have the same security
> > level or put the m-line with the highest level security first so that
> > if bundle is selected, we get the strongest security.
>
>
>
> Full discussion can be found here:
>  https://www.ietf.org/mail-archive/web/mmusic/current/msg17184.html
>
>
>
>
> Thanks
> Suhas
>
>
>
>
>
>
>