Re: [rtcweb] CNAMEs and multiple peer connections

[Magnus Westerlund <[e-mail]>]

On 2014-03-14 17:44, Justin Uberti wrote:

> 
> At an implementation level, one could imagine at least 3 policies for
> generating CNAMEs:
> a) per-session (i.e. per-PeerConnection)
> b) per-page (i.e. shared between all PCs on a page)
> c) per-page, persistent (i.e. shared between all PCs on a page,
> including across page loads)
> 
> While we seem to agree that a) is the right solution for CNAMEs, it is
> worth pointing out that we (Chrome) are currently doing c) for DTLS
> certificates, to avoid performance problems with cert generation at page
> load. Ergo, this linkability concern already exists, and I don't think
> it is easy to solve it in the default case. There have been some
> proposals to allow generation/storage of unique certs to prevent this
> linkability, but this will require app input.
> 
> Ergo, we might want to match the DTLS behavior (i.e. generate unique
> CNAMEs only when the certs are unique), to ensure we treat linkability
> consistently.

Actually, the DTLS cert and the CNAME is actually not equivalent when it
comes to visibility scope. The DTLS is show only to the DTLS peer, i.e.
the address at the other end of a peer connection. The CNAME in cases of
SFM or RTP mixer based using CSRC lists type of RTP middleboxes, can
result in the CNAME being forward to all participants in the same
multi-party conference.

Cheers

Magnus Westerlund

----------------------------------------------------------------------
Services, Media and Network features, Ericsson Research EAB/TXM
----------------------------------------------------------------------
Ericsson AB                 | Phone  [phone]
Färögatan 6                 | Mobile [phone]
SE-164 80 Stockholm, Sweden | mailto: [e-mail]
----------------------------------------------------------------------