Re: [RAI] MSRP Expert Review of draft-pd-dispatch-msrp-websocket-04

"Cullen Jennings (fluffy)" <> Wed, 29 January 2014 16:11 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 255601A03BF; Wed, 29 Jan 2014 08:11:43 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -115.036
X-Spam-Status: No, score=-115.036 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.535, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_WHITELIST=-100] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 4lXLrZn2Uabs; Wed, 29 Jan 2014 08:11:34 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id ADA621A03E8; Wed, 29 Jan 2014 08:11:30 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;;; l=1761; q=dns/txt; s=iport; t=1391011888; x=1392221488; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=Aanm7d3T4xziWPJycVHoiiYV57PaMbCogtcYwHvWFcQ=; b=eto8kBCIwlKRspX/Mc6toKZhhiFd9tNur0gJLa4SohwT7FucmQ2Sxsow NgDAH2OzSs7KX7KaJgDBK/ofznAYkG27GRiOqyccFr81Ofd/YY3512v39 yWOB4UL/Cqps0v+JKu+6HXOZOK6or2ET6na9irRULxQdjekJArbS0onCt s=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-AV: E=Sophos;i="4.95,742,1384300800"; d="scan'208";a="300521133"
Received: from ([]) by with ESMTP; 29 Jan 2014 16:11:27 +0000
Received: from ( []) by (8.14.5/8.14.5) with ESMTP id s0TGBRd4013026 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Wed, 29 Jan 2014 16:11:27 GMT
Received: from ([]) by ([]) with mapi id 14.03.0123.003; Wed, 29 Jan 2014 10:11:27 -0600
From: "Cullen Jennings (fluffy)" <>
To: Ben Campbell <>
Thread-Topic: [RAI] MSRP Expert Review of draft-pd-dispatch-msrp-websocket-04
Thread-Index: AQHPHQzD5NPJAZ1BGUCGp1O/NMagzw==
Date: Wed, 29 Jan 2014 16:11:26 +0000
Message-ID: <>
References: <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
x-originating-ip: []
Content-Type: text/plain; charset="Windows-1252"
Content-ID: <>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: DISPATCH <>, "" <>, "" <>
Subject: Re: [RAI] MSRP Expert Review of draft-pd-dispatch-msrp-websocket-04
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "Real-time Applications and Infrastructure \(RAI\)" <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 29 Jan 2014 16:11:43 -0000

I don’t see why using websockets would require us to get rid of the MUST use TLS. 

The security of relays is a total disaster if you don’t have this so if the MUST be security authenticated goes away for relays, then I suspect this mechanisms is too broken to publish.

Cullen ( in my individual contributor role just to be clear )

On Jan 11, 2014, at 2:54 PM, Ben Campbell <> wrote:

> On Jan 10, 2014, at 5:34 PM, Ben Campbell <> wrote:
>> --3
>> I am not happy with the downgrade of of the TLS requirement between client and relay. I recognize that WebSocket
> Robert pointed out to me that my comments on this section were truncated. Apparently I'm not qualified for this email gizmo. Here's another try:
> I recognize that the WebSocket API limits the application's ability to control the security parameters of the connection. I think this is a general issue for moving application protocols to use WebSocket, that perhaps needs to be addressed in the WebSocket API.  We probably need an whole IETF (or at least RAI+APPS) policy for how to handle this. But MSRP is somewhat unusual in having a "MUST use" TLS requirement, and in the current security climate we need to take a really hard look at anything that weakens the normative security requirements of a messaging protocol.
> I don't have an answer for how to proceed, but at a minimum I would like to see considerably more discussion of the implications and any potential mitigation of this in the Security Considerations sections.
> _______________________________________________
> RAI mailing list