Re: [RAI] [dispatch] MSRP Expert Review of draft-pd-dispatch-msrp-websocket-04

Ben Campbell <> Wed, 29 January 2014 18:17 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 1A0FD1A0369; Wed, 29 Jan 2014 10:17:13 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.036
X-Spam-Status: No, score=-1.036 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HELO_MISMATCH_COM=0.553, HOST_MISMATCH_NET=0.311] autolearn=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id U7m32hf_igpH; Wed, 29 Jan 2014 10:17:12 -0800 (PST)
Received: from ( [IPv6:2001:470:1f03:267::2]) by (Postfix) with ESMTP id E9C291A021B; Wed, 29 Jan 2014 10:17:11 -0800 (PST)
Received: from [] ( []) (authenticated bits=0) by (8.14.3/8.14.3) with ESMTP id s0TIGseM008270 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Wed, 29 Jan 2014 12:16:55 -0600 (CST) (envelope-from
Content-Type: text/plain; charset=iso-8859-1
Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\))
From: Ben Campbell <>
In-Reply-To: <>
Date: Wed, 29 Jan 2014 12:16:53 -0600
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
References: <> <> <> <> <> <> <>
To: Peter Dunkley <>
X-Mailer: Apple Mail (2.1827)
Received-SPF: pass ( is authenticated by a trusted mechanism)
Cc: Cullen Jennings <>, =?iso-8859-1?Q?I=F1aki_Baz_Castillo?= <>, DISPATCH <>, "" <>, "" <>
Subject: Re: [RAI] [dispatch] MSRP Expert Review of draft-pd-dispatch-msrp-websocket-04
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "Real-time Applications and Infrastructure \(RAI\)" <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 29 Jan 2014 18:17:13 -0000

On Jan 29, 2014, at 11:30 AM, Peter Dunkley <> wrote:

> Point 1) is terribly important IMHO. Note that for WebRTC applications
> to be "friendly" HTTPS is required (so the user is not prompted by the
> browser for permission every time a WebRTC session is requested via
> getUserMedia). So let's assume that WebRTC, in fact, requires HTTPS.
> Taking into account point 1) above, we also need Secure WebSocket
> ("wss") for MSRP or for anything.
> Which is great on the Internet but a real pain on an internal network where you don't want to pay for a certificate or import something into every single device/computer on your network.  That's the same reason people usually don't use HTTPS on internal networks!

I assumed MSRP/WebSocket was intended for the Internet. If not, perhaps an applicability statement would be in order, even if just for this particular requirement--although I tend to be skeptical of or "MUST use unless you are on a private network" constructs. But I can see situations where, for example, you've got protection at a lower layer (e.g. IPSec, VPNs, etc.) where it might make sense.

(BTW, more and more enterprise networks are moving to use HTTPS internally.)

> Hence my belief that SHOULD was the right thing here.  People SHOULD use TLS security, but saying MUST will just mean that this is a MUST people ignore on certain deployment types.  What is the point of mandating something when people will just ignore it when it doesn't suit them?
> I get that security is important and the IETF is full of security idealists, and all IETF protocols should be secure, by in this particular situation it feels like using MUST instead of SHOULD would be done simply because in the IETF you always say MUST for security (whether people will use it or not).

Actually, not so many IETF protocols say "MUST use". "MUST implement" is more common. But MSRP was an attempt to move to a more secure model, so the authors are going to be sensitive to anything that reduces that. And I suspect you will see more "MUST use" requirements these days than you might have this time last year.

Again, I think we should consider a wider policy on how to apply application protocol security requirements when the application moves to WebSocket. MSRP is an interesting test case due to the "MUST use" requirement.