Re: [rtcweb] draft-ietf-rtcweb-security-arch: Questions on SDP identity attribute

[Christer Holmberg <[e-mail]>]

Hi,

> You are right Christer, I was looking at this the wrong way of how it was used vs the defn. of Identity. 
> Let me answer the questions from only the point of view how the Identity header is defined by 
> draft-ietf-rtcweb-security-arch and not how the identity header is used in WebRTC in general. 
> 
>> Q1:
>> ----
>>  
>> The draft says that, at minimum, the fingerprint needs to be bound to the identity.
>>  
>> Does this mean that, in order to include an SDP identity attribute in an offer/answer, the offer/answer MUST 
>> also contain at least one SDP fingerprint attribute? Based on the text about generating the identity it seems 
>> like that, but it is not very clear in the SDP procedures.
>  
> It seems to me that the defn of an Identity header does not need it to be use for fingerprints at all. What goes in it the 
> assertion is pretty much determined by the IdP. Some future system that did not have fingerprints but used token binding 
> or blockchain style smart contracts could probably work just fine. It’s up to the IdP. 
>
> So I might be wrong but I would say that Identity header does not require a fingerprint to be in the SDP, but when Identity 
> is used in WebRTC, there will also be a fingerprint. 

But, the text says that, at a minimum, the fingerprint needs to be bound to the identity.

If that is not true, that statement needs to be removed/modified. If it does apply to WebRTC, it needs to be clear that it is a WebRTC requirement, not a generic attribute requirement.

---

>> Q2:
>> ----
>>  
>> Section 5.6.4.1 says:
>>    "The "a=identity" attribute MUST include all
>>    fingerprint values that are included in "a=fingerprint" lines."
>>  
>> First, related to the generation of the assertion value, it is unclear how this is implemented. For example, is 
>> there a separate JSON object (section 5.6.4) provided to the IdP for each fingerprint? The text talks about “single” 
>> fingerprint in the object. Or, are all fingerprints included in the same JSON object?
>  
> As you point out, all that is the Identity assertion definition defines is how to encode it and that’s base 64 of JSON 
> so that part is fine. Section 5.6.4.1 is about how it Identity is used in the contact of WebRTC. How the IdP does this is 
> pretty out of scope of IETF stuff but I think you raise a good point that this implies that in the WebRTC case, if there 

My question was whether each assertion will be in a separate JSON. But, when re-reading the draft I think I found the answer. The ABNF can contain multiple assertions, and there is text saying that each assertion is a JSON.

>> Second, it is unclear what “attribute MUST include all fingerprint values” means. I assume that the attribute will only 
>> include a single attribute assertion value, but that the value will be generated by the IdP based on all fingerprint values?

---

>> Q3: 
>> ----
>>  
>> In the example in Section 5.6.4.1 the SDP fingerprint attribute is included as a session-level attribute. However, it 
>> is a media-level attribute. AFAIR, media-level attributes cannot be included as session-level attributes.
>   
> Section 8 of RFC4572 that defines the fingerprint attribute says that it is both at session and media-level attribute. 
> (2nd para of https://tools.ietf.org/html/rfc4572#section-8 ) 

Yes, but this draft defines the Identity attribute :)

Just because the Identity attribute can be used together with the Fingerprint attribute it doesn't mean that it automatically inherits the properties of the Fingerprint attribute - especially since you earlier indicated that there may be cases where the fingerprint isn't even used for the assertion. The definition of the Identity attribute needs to state whether it can be used on session and/or media-level.

Regards,

Christer