[MMUSIC] BUNDLE - MID Security - Updated text proposal

[Magnus Westerlund <[e-mail]>]

Hi,

I didn't receive any feedback. Below you will find a further updated 
text proposal attempting to be non-controversial. If you find the below 
erroneous or problematic, I do need you to speak up, because then I 
don't understand your issue:


---- Text Proposal ----

The identfication-tag when included in the RTP MID SDES item, 
independent of transport, RTCP SDES packet or RTP header extension, can 
expose the value to parties beyond the signaling chain. Therefore, the 
identification-tag MUST NOT contain any user related information for 
privacy reasons, nor hardware based identifiers. That as such 
information could enable tracking of the sending end point.

The identification-tag is used to route the media stream to the right 
application functionality, thus is important that the value received is 
the one intended by the sender. Malicious modifications can result in 
that a media stream is wrongly attributed or fails to be played. Thus, 
verifying integrity and the authenticity of the source are RECOMMENDED 
to prevent these attacks on the application. Security mechanisms for 
RTP/RTCP are discussed in Options for Securing RTP Sessions [RFC7201].

---- End of Text Proposal ----

There has been discussion if the MID identification-tag should have a 
proposed or mandated construction pattern. I think there are benefits to 
that. Using the same ASCII based pattern that RID suggest is fine, 
however I think it can clarify which character in the range above dec 48 
("0") in the ASCII table should be used, and if one have more tags than 
what fits a single character, what one would do in that case.

Cheers

Magnus Westerlund

----------------------------------------------------------------------
Services, Media and Network features, Ericsson Research EAB/TXM
----------------------------------------------------------------------
Ericsson AB                 | Phone  [phone]
Färögatan 6                 | Mobile [phone]
SE-164 80 Stockholm, Sweden | mailto: [e-mail]
----------------------------------------------------------------------