Re: [rtcweb] DTLS, DTLS-SRTP, and 5-tuples

[Roman Shpount <[e-mail]>]

On Wed, Mar 4, 2015 at 1:12 PM, Simon Perreault <[e-mail]> wrote:

> This is a follow-up to this thread on discuss-webrtc:
> https://groups.google.com/forum/#!topic/discuss-webrtc/i67xq-FWtoM
>
> If I'm not mistaken, the right thing to do would be to bind keying
> material to all local ICE candidates (multiple 3-tuples), and treat any
> incoming media flow as indicated in RFC 5764 page 15, with one mapping
> table per 3-tuple. For outgoing flows, I guess it would make most sense to
> bind keying material to the 5-tuples for which the sender has obtained
> consent.
>
> Is this correct? If so, would it be useful to add text explaining this in
> detail?
>
>
This is not correct. End point can have multiple flows with different
keying material or different DTLS sessions on the same local ICE 3-tuple
due to forking. More correct implementation would be to associate multiple
5-tuples with the same logical transport stream based on ICE connectivity
checks using ICE ufrag to identify which logical stream to associate with
each 5-tuple.

There is also another interesting consequence of this -- end point should
not re-use the same ICE candidate IP/port with a different ufrag during
session update offer/answer exchange. Otherwise you might end up with
ambiguous association between the logical streams and keying material or
DTLS session.

All of this probably needs to be defined somewhere and I am not aware which
RFC or draft defines this at this time.
_____________
Roman Shpount