[MMUSIC] BUNDLE: Security Considerations TODO

Christer Holmberg <christer.holmberg@ericsson.com> Tue, 02 September 2014 11:58 UTC

From: Christer Holmberg <christer.holmberg@ericsson.com>
To: "mmusic@ietf.org" <mmusic@ietf.org>
Thread-Topic: BUNDLE: Security Considerations TODO
Thread-Index: Ac/GpPCc0BjMvt9sS/eXLDrXXGt9sg==
Date: Tue, 02 Sep 2014 11:58:17 +0000
Message-ID: <7594FB04B1934943A5C02806D1A2204B1D4371AC@ESESSMB209.ericsson.se>
Accept-Language: en-US
Content-Language: en-US
Content-Type: multipart/alternative; boundary="_000_7594FB04B1934943A5C02806D1A2204B1D4371ACESESSMB209erics_"
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/mmusic/v-oZAbQzORwuG1t8Jjhz46WXENo
Subject: [MMUSIC] BUNDLE: Security Considerations TODO
Precedence: list

Hi,

In BUNDLE, we have the following TODO in the security considerations:

  "TODO: Think carefully about security analysis of reuse of same SDES
   key on multiple "m=" lines when the far end does not use BUNDLE and
   warn developers of any risks."

Isn't this solved by including unique keys in the initial offer, and then use the same keys IF the other endpoint use BUNDLE - similar to ICE candidates etc?

I would be thankful for any input text in order to address this :)

Regards,

Christer

[MMUSIC] BUNDLE: Security Considerations TODO Christer Holmberg