Re: [rtcweb] DTLS, DTLS-SRTP, and 5-tuples

[Roman Shpount <[e-mail]>]

On Thu, Mar 5, 2015 at 4:52 AM, Iñaki Baz Castillo <[e-mail]> wrote:

> 2015-03-05 7:58 GMT+01:00 Christer Holmberg <
> [e-mail]>:
> > As far as I understand, sending of multiple ClientHellos, on different
> > 5-tuples, would require a change to core DTLS (not only DTLS-SRTP), and
> who
> > knows how long such work would take. Do we really want to add such
> > dependency to our deliveries at this point?
>
> Sorry, I think I didn't explain well.
>
> It is not about multiple DTLS connections, but about the fact that
> DTLS packets belonging to the *same* DTLS connection/association can
> be carried over different 5-tuples. This may happen during agressive
> ICE nomination in which media (so the DTLS ClientHello) follows the
> USE-CANDIDATE Binding request without even waiting for a response.
>

When was it agreed that DTLS ClientHello can be sent before the
connectivity check succeeded? I understand that this will increase the
connection setup time, but I though that no data should be sent before the
connectivity check response (consent) from the remote party.

> In addition, do we expect existing DTLS implementations to support this?
>
> There is nothing new to implement in DTLS libraries. It is just the
> the DTLS user must not assume a single and fixed 5-tuple
>
>
> > If one doesn't want to re-establish DTLS when jumping between candidates,
> > doesn't it work by creating separate DTLS connections for each candidate?
>
> This subject has been heavily discussed time ago:
>
> http://www.ietf.org/mail-archive/web/mmusic/current/msg13637.html
>
> No, there MUST NOT be separate DTLS connection for each candidate-pair.
>

Agreed
_____________
Roman Shpount