Re: [rtcweb] Mandating encryption of RTP header extensions for MID and RID SDES items

[Magnus Westerlund <[e-mail]>]

Den 2016-10-09 kl. 12:24, skrev Christer Holmberg:
> Hi,
>
> On the MMUSIC list Jonathan L informed the community about the following text in RFC 7904 (SDES header extensions):
>
>    "In RTP sessions where any type of confidentiality protection is
>    enabled for RTCP, the SDES item header extensions MUST also be
>    protected."
>
> So, *IF* we assume that "any type of confidentiality protection" is enabled for RTCP, I guess the answer is pretty clear, or?
>

Yes, from my perspective this is settled. RFC 7904 forces encryption of 
the MID value in an WebRTC context. If the RTCWeb WG do not agree with 
this, then it needs to work on changing RFC 7904. I do not support 
chaning that RFC's conclusion that information that is protected in RTCP 
needs to be protected also in RTP headers.

When it comes to the information leakage and the fingerprinting 
possibilities of SSRCs, PTs etc, it is present and getting worse in 
multi-stream systems.

So when you had a single media stream per endpoint and that used a 
random SSRC and one PT value during the life-time of the RTP session, 
there is very little information leakage here. The codec possibly leaks 
through PT, but the packet length, at least for audio leaks that 
information anyway.

However, when one starts to have a endpoint that uses multiple media 
streams, and certain configurations of RTX and FEC, then the publicly 
visable fingerprinting surface from RTP streams goes up. Now both 
implementation choices as well as device hardware configurations starts 
to show in the unencrypted RTP headers. So MID and RID is one additional 
parameter that increases the potential for fingerprinting here.

So what is the reason given that we protect the RTP payload and the RTCP 
packets with encryption, to not also protected the RTP header extensions?

Cheers

Magnus Westerlund

----------------------------------------------------------------------
Services, Media and Network features, Ericsson Research EAB/TXM
----------------------------------------------------------------------
Ericsson AB                 | Phone  [phone]
Färögatan 6                 | Mobile [phone]
SE-164 80 Stockholm, Sweden | mailto: [e-mail]
----------------------------------------------------------------------