Re: [rtcweb] [MMUSIC] Draft new: draft-wang-mmusic-encrypted-ice-candidates

[Harald Alvestrand <[e-mail]>]

Den 11.11.2019 10:03, skrev Sean DuBois:
> On Fri, Nov 01, 2019 at 01:06:22PM -0700, Qingsi Wang wrote:
>> Greetings.
>>
>> This draft (
>> https://tools.ietf.org/html/draft-wang-mmusic-encrypted-ice-candidates-00)
>> proposes a complementary solution to the mDNS candidate detailed
>> in draft-ietf-rtcweb-mdns-ice-candidates, specifically for managed
>> networks. IPs of ICE candidates are encrypted via PSK and signaled as
>> pseudo-FQDNs in this proposal, and it aims to address the connectivity
>> challenge from the mDNS technique in these managed environments. The
>> current work on this draft is tracked in
>> https://github.com/tQsW/encrypted-ice-candidates.
>>
>> Regards,
>> Qingsi
> 
>> _______________________________________________
>> rtcweb mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/rtcweb
> 
> Hi,
> 
> Really excited to see this RFC. This is a real pain point, and glad it
> is being addressed. I implemented this over the weekend and everything
> fell into place.
> 
> Have you thought about/explored encrypting the entire SessionDescription?

This would destroy interoperability with any currently fielded
implementation, so it's unlikely to be popular.
It also requires setting up a shared key before you can exchange SDP,
which is a pain (as this draft makes clear).

> There might be some issues I am not aware of, but it would give us some
> other nice things!
> 
> * No more SDP munging (or at least make it harder)
>    - People shoot themselves in the foot constantly by editing things
>    - Will push people to communicate API needs more, instead of more hacks
> 
> * Host candidates aren't the only thing you can be fingerprinted off of
>   - Agents craft very different SDPs (FireFox vs Chromium)
>   - SDPs reveal hardware attributes (Chromium Android has H264 only with HW Accel)
>   - Agent may have different experiments/settings (attributes at session/media level)
> 
> * Changes to candidate strings is going to cause more breakage
>   Maybe this doesn't matter as much, but I anticipate this is going to
>   cause more bugs. Some clients/SFUs/MCUs... blew up when mDNS came out,
> 
>   I bet another change is going to cause the same thing. It sounds like
>   this will be much less likely because people will need to setup
>   something up to get the PSK going.
> -------
> 
> I would love to see example implementations of the Key Management. Is
> there any precedent for configuration of the WebRTC agent in managed
> networks?
> 
> _______________________________________________
> mmusic mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/mmusic
>