Re: [rtcweb] JSEP fingerprint hash requirements

FWIW others have complained about this exact thing in JSEP and it will be
fixed in the -05 version (to agree with 4572).

On Thu, Oct 17, 2013 at 11:54 AM, Martin Thomson
<martin.thomson@gmail.com>wrote:

> On 17 October 2013 01:37, Kevin Dempsey <kevindempsey70@gmail.com> wrote:
> > 1) does the fingerprinh hash need to match the certificate
>
> Yes.  Without that, you've got no binding between signaling and media
> path, which is bad.
>
> > 2) do webrtc compatible endpoints need to handle hashes 'weaker' than
> > sha-256
>
> No.  RFC 4572 is clear:
>    A certificate fingerprint MUST be computed using the same one-way
>    hash function as is used in the certificate's signature algorithm.
>
> That means that you need to generate the certificate with a hash that
> is strong enough.
>
> > 3) are there any rules for handling multiple fingerprints?
>
> RFC 4572 is silent on that, unless I missed something, which I
> probably did.  The only plausible choice given the above statement
> from 4572 is to suggest that multiple a=fingerprint values indicate
> alternative certificates.
>
> That should probably be written down, of course.
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb
>