Re: [rtcweb] DTLS, DTLS-SRTP, and 5-tuples

Justin Uberti <juberti@google.com> Mon, 09 March 2015 23:41 UTC

Return-Path: <juberti@google.com>
X-Original-To: rtcweb@ietfa.amsl.com
Delivered-To: rtcweb@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E7B21A01D5 for <rtcweb@ietfa.amsl.com>; Mon, 9 Mar 2015 16:41:58 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.388
X-Spam-Level:
X-Spam-Status: No, score=-1.388 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mKTe8q4kNVsr for <rtcweb@ietfa.amsl.com>; Mon, 9 Mar 2015 16:41:56 -0700 (PDT)
Received: from mail-ie0-x236.google.com (mail-ie0-x236.google.com [IPv6:2607:f8b0:4001:c03::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5F7AA1A88A6 for <rtcweb@ietf.org>; Mon, 9 Mar 2015 16:41:56 -0700 (PDT)
Received: by iecrl12 with SMTP id rl12so25303473iec.8 for <rtcweb@ietf.org>; Mon, 09 Mar 2015 16:41:55 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=CWoPYczfWhLPlwvEaa5sr7Iwbu78VP5Uu/X7XcetI0A=; b=iPhxncb83lnI5OPhDwy2+inx4hoez0PH+9LReUuADW/V5LJkYdT8Adlz9SBZaw3epw HnttXA/VDB1peiAod/nZQFBxaLVNc+TldwyBDs31Dag/2cGKf4/4iTdrcUrSBaFnxUFr +d8M6DXdf8JD0ea73hOYShP7LvziXVWAgFXPd+grgRz2bWuzoAxWFQeI1FmtIGyl5aaM wFZM/oJyuRMyprNmIf6PuysyH7ClWgICYSdY8Z1rl6hTpjgkwuijRVKFa3Xp/u+GlwAQ 3iJQw0fhjAQH77QYXcWp2MNjH0N81G6COEURrCDebHVAsbYaIvY70TE5VmgXn7DTazWz yqvA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=CWoPYczfWhLPlwvEaa5sr7Iwbu78VP5Uu/X7XcetI0A=; b=N6uHeAci5vDNhjnKawt0xYSeW6CG1zc5JazKPMVuFbtQxC7W5SJdOl+J7BKAPjBAP/ hbklQABqCpIkR33FZIlJspUUNZjtpcdl/uWxeyZcsM7nH5JKpttVXSROxQbPBlCN7IG7 vxqlqIwI11BXkkdYAFgcxovGcsbnDxRdP1bWYW02FO7dA5xaAq5E1CQ9MSfrvEOyQppE 0bWFOif0B+BPIiz5iZW4CUbc/WWHAwFes4xysYfz5KF8v5N8gTIjgy3nf9mCwvj4zspB JqOSgFEl2R6+wBvmkd1Xx1OLonYU+8n0hxpKfhdW810n5U1qQMr6Co7xWIQyJLhEIxQu uKVg==
X-Gm-Message-State: ALoCoQmPL7b/NiWrF8E3DaaLMSabIElQI8v8Nl2C5IW5rMOLuq0rjASSjbyQKAn2X7UbPNo/tAcc
X-Received: by 10.107.15.155 with SMTP id 27mr33765171iop.49.1425944515804; Mon, 09 Mar 2015 16:41:55 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.64.64.42 with HTTP; Mon, 9 Mar 2015 16:41:34 -0700 (PDT)
In-Reply-To: <2F467A7E-7A6C-4B1B-985A-0D9C089BE973@cisco.com>
References: <54F74B02.1070902@jive.com> <CAD5OKxs8JYG3-Vvndi59ZrdPE7UTj22ozD4tcWTHgzWrHv=q7Q@mail.gmail.com> <54F756B2.60408@jive.com> <7594FB04B1934943A5C02806D1A2204B1D726AD8@ESESSMB209.ericsson.se> <CAD5OKxu7py3HbrFjxTDZS5ECFzx7vd=wpjve-gT6gWwksjEu+g@mail.gmail.com> <7594FB04B1934943A5C02806D1A2204B1D726B71@ESESSMB209.ericsson.se> <CABcZeBO1O6sA8MqvWkCDu3RPLz5-P2G65Us28i0baOavDnRT7Q@mail.gmail.com> <CAD5OKxuWCdgMR5Kxjv9BSwZ3Jm9kGXx9Pi-9FrfsnuQZ_91jAA@mail.gmail.com> <7594FB04B1934943A5C02806D1A2204B1D726DC1@ESESSMB209.ericsson.se> <CALiegfkipJhsy7-40+=d9xMUf4RJGdn3_fABL3NN2KuFNvS2BA@mail.gmail.com> <7594FB04B1934943A5C02806D1A2204B1D727570@ESESSMB209.ericsson.se> <CALiegfmfvz3NWSjcovGBytiOTbR6kFfyh0vx5cXoMJtytfGzRA@mail.gmail.com> <CAD5OKxsu3D0xHY-zYbDu1hyH_+4=3mWDvW2i98WCVZ+29BpKCw@mail.gmail.com> <CA5E97EE-99F8-44D8-B05B-C9EFDED1A9BB@vidyo.com> <2F467A7E-7A6C-4B1B-985A-0D9C089BE973@cisco.com>
From: Justin Uberti <juberti@google.com>
Date: Mon, 09 Mar 2015 16:41:34 -0700
Message-ID: <CAOJ7v-1TjZOZ5G31vy_Gt73ADGLRay1RHVeMi=H6Q4=N1b6HLA@mail.gmail.com>
To: Cullen Jennings <fluffy@cisco.com>
Content-Type: multipart/alternative; boundary="001a113eeca855a22a0510e3940e"
Archived-At: <http://mailarchive.ietf.org/arch/msg/rtcweb/g8wakoEQahs8TAynU_cdDGIf2Bg>
Cc: Jonathan Lennox <jonathan@vidyo.com>, "rtcweb@ietf.org" <rtcweb@ietf.org>
Subject: Re: [rtcweb] DTLS, DTLS-SRTP, and 5-tuples
X-BeenThere: rtcweb@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <rtcweb.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/rtcweb/>
List-Post: <mailto:rtcweb@ietf.org>
List-Help: <mailto:rtcweb-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 09 Mar 2015 23:41:58 -0000

On Mon, Mar 9, 2015 at 8:28 AM, Cullen Jennings <fluffy@cisco.com> wrote:

>
> > On Mar 5, 2015, at 8:22 AM, Jonathan Lennox <jonathan@vidyo.com> wrote:
> >
> >
> > On Mar 5, 2015, at 5:14 AM, Roman Shpount <roman@telurix.com> wrote:
> >
> >> On Thu, Mar 5, 2015 at 4:52 AM, Iñaki Baz Castillo <ibc@aliax.net>
> wrote:
> >> 2015-03-05 7:58 GMT+01:00 Christer Holmberg <
> christer.holmberg@ericsson.com>:
> >> > As far as I understand, sending of multiple ClientHellos, on different
> >> > 5-tuples, would require a change to core DTLS (not only DTLS-SRTP),
> and who
> >> > knows how long such work would take. Do we really want to add such
> >> > dependency to our deliveries at this point?
> >>
> >> Sorry, I think I didn't explain well.
> >>
> >> It is not about multiple DTLS connections, but about the fact that
> >> DTLS packets belonging to the *same* DTLS connection/association can
> >> be carried over different 5-tuples. This may happen during agressive
> >> ICE nomination in which media (so the DTLS ClientHello) follows the
> >> USE-CANDIDATE Binding request without even waiting for a response.
> >>
> >> When was it agreed that DTLS ClientHello can be sent before the
> connectivity check succeeded? I understand that this will increase the
> connection setup time, but I though that no data should be sent before the
> connectivity check response (consent) from the remote party.
> >
> > As I understand the current rough consensus, the endpoint has to have
> received a successful response to a connectivity check on the 5-tuple,
> proving consent, but it doesn’t have to have received (or sent) a check
> with a USE-CANDIDATE attribute in it yet.
> >
> > This was the outcome of our discussion “merging" regular and aggressive
> ICE nomination.
>
> That matches my understanding of how things work.
>
>
That discussion is now codified in a new draft,
https://tools.ietf.org/html/draft-uberti-mmusic-nombis-00.

To handle the issue raised by the OP, I think we should either
1) Fix the DTLS draft (and any others) to not be bound to a 5-tuple when
ICE is used
2) Update ICE-bis to say that any language about 5-tuples is invalidated by
ICE, and should be treated as a virtual transport.

#2 seems like the simplest path at this point, given that ICE-bis work is
underway.