Re: [MMUSIC] Review of draft-ietf-mmusic-sdp-bundle-negotiation-32 - Magnus' comments - MID security

[Cullen Jennings <[e-mail]>]

> On Oct 7, 2016, at 1:41 AM, Magnus Westerlund <[e-mail]> wrote:
> 
> Den 2016-10-06 kl. 23:59, skrev Cullen Jennings:
>> 
>> I'm not getting the problem here and mandating 6904 is not an easy
>> thing to do.
> 
> So, lets be clear on what I have proposed. For bundle in general it is RECOMMENDED to encrypt MIDs in RTP header extensions. I have also proposed that for RTCWeb implementation and use should be mandated. I was not clear in what applies when an WebRTC endpoint talks to a legacy endpoint what is expected here. I guess this is the thorny issue.
> 
>> 
>> I'm not getting what the issue is here. If mid are random, or are
>> just a count of n'th m-line in the sdp, what is the problem with
>> exposing them to people are getting the media?
> 
> The issue is that these identifiers are going from having only been visiable in the signalling messages to be visible also on the RTP media plane. And without RFC6904 even if one uses SRTP, these values are exposed. This have several different effects as I see it. So if the generation algorithm are not strictly defined, the implementation gets possible to fingerprint. In addition the device gets to be fingerprinted based on the number of streams offered and their identifiers. Thus, it is not only what is actually used that is exposed, but what was originally offered, i.e. the full offer leaks into unencrypted domain on the media plane. Note, this later can't be dealt with any mid id creation rules, it will still leak. Thus devices that have more exotic configurations when it comes to media streams, i.e. number of cameras etc this can still be fingerprinted by passive attacks from third parties.
> 
> It is the passive attack from third parties that has me worried here. A peer in the signalling has massively more powerful fingerprinting, but that requires one to be in the signalling context, not passively observe traffic that goes past.
> 

I'm still not getting the fingerprint problem. How is this different than PT and SSRC. Yes, I agree the MID and RID - which were always intended to go in the RTP packet need to be generated not to have sensitive information in them.