Re: [rtcweb] DTLS, DTLS-SRTP, and 5-tuples

[Simon Perreault <[e-mail]>]

Le 2015-03-04 13:54, Roman Shpount a écrit :
> This is not correct. End point can have multiple flows with different
> keying material or different DTLS sessions on the same local ICE 3-tuple
> due to forking. More correct implementation would be to associate
> multiple 5-tuples with the same logical transport stream based on ICE
> connectivity checks using ICE ufrag to identify which logical stream to
> associate with each 5-tuple.

Agreed.

> There is also another interesting consequence of this -- end point
> should not re-use the same ICE candidate IP/port with a different ufrag
> during session update offer/answer exchange. Otherwise you might end up
> with ambiguous association between the logical streams and keying
> material or DTLS session.

Right. And wait MSL seconds before reusing a candidate to let the pipes 
drain.

> All of this probably needs to be defined somewhere and I am not aware
> which RFC or draft defines this at this time.

I guess for DTLS/DTLS-SRTP the obvious target would be -security...

Simon