Re: [rtcweb] draft-ietf-rtcweb-security-arch: Questions on SDP identity attribute

> On May 11, 2018, at 4:20 AM, Christer Holmberg <christer.holmberg@ericsson.com> wrote:
> 
> Hi,
> 
> A few questions/comments on the SDP identity attribute.
> 
> Q1:
> ----
> 
> The draft says that, at minimum, the fingerprint needs to be bound to the identity.
> 
> Does this mean that, in order to include an SDP identity attribute in an offer/answer, the offer/answer MUST also contain at least one SDP fingerprint attribute? Based on the text about generating the identity it seems like that, but it is not very clear in the SDP procedures.
> 
> 

JSEP requires DTLS/SRTP which requires adding the fingerprint so I think this is already required. Also JSEP points out lack of fingerprint will cause negotiation failure. 

> Q2:
> ----
> 
> Section 5.6.4.1 says:
>    "The "a=identity" attribute MUST include all
>    fingerprint values that are included in "a=fingerprint" lines."
> 
> First, related to the generation of the assertion value, it is unclear how this is implemented. For example, is there a separate JSON object (section 5.6.4) provided to the IdP for each fingerprint? The text talks about “single” fingerprint in the object. Or, are all fingerprints included in the same JSON object?

Yah, I think it would get a Identity token for each fingerprint via a Generate Assertion for each fingerprint. But I think that is largely WebRTC issue. 

> 
> Second, it is unclear what “attribute MUST include all fingerprint values” means. I assume that the attribute will only include a single attribute assertion value, but that the value will be generated by the IdP based on all fingerprint values?

So if there were multiple fingerprint, the SDP would have multiple Identity lines.

> 
> 
> Q3: 
> ----
> 
> In the example in Section 5.6.4.1 the SDP fingerprint attribute is included as a session-level attribute. However, it is a media-level attribute. AFAIR, media-level attributes cannot be included as session-level attributes.
> 

I think fingerprint is valid as both session-level or media-level so I suspect this is fine. JSEP also says that if the certs are the same, then it can be session level but if different then must be media level. So I think this is covered in JSEP. 

> Regards,
> 
> Christer
> 
> 
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb