Re: [MSEC] Application layer multicast security protocol

> -----Original Message-----
> From: Sheela Rowles (sheela) [mailto:sheela@cisco.com]
> Sent: Wednesday, August 24, 2011 7:11 AM
> To: Adrian-Ken Rueegsegger; sampreeth ramavana; Dan Wing (dwing)
> Cc: msec@ietf.org
> Subject: RE: [MSEC] Application layer multicast security protocol
> 
> Added Dan Wing since the GDOI/SRTP draft was dropped because Dan Wing
> had an alternative draft.  Sorry can't remember the details now.

(Sorry for my late response.)

A problem with using GDOI to distribute SRTP keys is it requires 
an additional signaling infrastructure: the call itself has to
be signaled (codec, IP address/port, etc.) to the participants 
using existing call signaling (e.g., SIP), but GDOI introduces
an additional signaling protocol so those participants can obtain
the necessary keys.  This separate mechanism requires its own
signaling (which means worrying about NAT traversal and 
associated keepalive traffic, and so on), and unless all keys
for all speakers are distributed early (before the speaker
talks), adds delay before media from a new speaker can be 
decrypted.

Instead, we can distribute the initial SRTP key in SIP or via
DTLS-SRTP, and change the SRTP key (such as when the participant 
list changes or a new speaker talks) in the media path itself 
(using RTP or RTCP).  This is done with 
http://tools.ietf.org/html/draft-ietf-avt-srtp-ekt.  This doesn't 
use additional ports and allows fate sharing between
the key changes and the SRTP packets (because the key changes can
be carried in the SRTP packets themselves).  We find this useful
when a new speaker says something in a conference (as their SRTP
key can be included in their very first SRTP packet, without delay
and without coordinating with key distribution via SIP or via
GDOI).

-d

> Sheela
> 
> -----Original Message-----
> From: msec-bounces@ietf.org [mailto:msec-bounces@ietf.org] On Behalf Of
> Adrian-Ken Rueegsegger
> Sent: Tuesday, August 23, 2011 11:54 PM
> To: sampreeth ramavana
> Cc: msec@ietf.org
> Subject: Re: [MSEC] Application layer multicast security protocol
> 
> Hi Sampreeth,
> 
> On 08/24/2011 07:35 AM, sampreeth ramavana wrote:
> > Hi All,
> >
> > Is there any multicast security protocol that can be implemented in
> > the application layer?
> >
> > I was seeing the GDOI protocol was mainly talking about implementing
> > using the IPSec at the IP layer. Can GDOI protocol also be useful if
> > implemented at application layer.
> 
> GDOI can be extended to provide key material for other protocols. Mark,
> Sheela and I wrote a draft (which has since expired) which specifies
> the
> usage of GDOI with SRTP [1].
> 
> Regards,
> Adrian
> 
> [1] - http://tools.ietf.org/html/draft-ietf-msec-gdoi-srtp
> _______________________________________________
> MSEC mailing list
> MSEC@ietf.org
> https://www.ietf.org/mailman/listinfo/msec