Re: [rtcweb] New Version Notification for draft-jesup-rtcweb-data-01.txt

[Michael Tüxen <[e-mail]>]

On Nov 11, 2011, at 6:14 PM, Eric Rescorla wrote:

> On Fri, Nov 11, 2011 at 9:01 AM, Michael Tüxen
> <[e-mail]> wrote:
>> On Nov 11, 2011, at 3:51 PM, Eric Rescorla wrote:
>> 
>>> On Fri, Nov 11, 2011 at 5:15 AM, Michael Tuexen
>>> <[e-mail]> wrote:
>>>> Hi Michael,
>>>>>  o DTLS and SCTP handshakes must be performed serially (no matter which order they happen in), which increases the number of round-trips necessary to establish communication.
>>>> That is correct. SCTP adds one RTT to whatever DTLS is requiring.
>>>> So when using SCTP/DTLS/UDP, DTLS needs 3 RTTs (including the initial
>>>> RTT required for the Cookie exchange).
>>>> When using DTLS/SCTP/UDP DTLS needs 2 RTTs (since there is no need for
>>>> the DTLS Cookie).
>>> 
>>> There's no need for the DTLS cookie in either case, actually, since ICE provides
>>> the appropriate proof of return routability.
>> I don't know much about ICE....
>> So assume that the endpoint willing to accept DTLS connections.
>> Can't I just send an ClientHello via plain UDP to the endpoint (assuming that I can reach it)?
> 
> When ICE is involved, there's no real concept of "an endpoint willing to
> accept DTLS connections". At a high level, the way that ICE works is
> that the communicating parties establish a session out of band and
> then use the ICE handshake to bind one or valid 5-tuple flows to the
> the session. Packets that arrive at one endpoint that aren't part of one
> of these flows can more or less be discarded. (At least at this stage).
OK, you you only pass those packets to DTLS, which belong to the 5 tuple
which you have already communicated with, and discard the others, it is OK.
So SCTP needs one RTT, DTLS two.

Thanks for the clarification.

Best regards
Michael
> 
> Since the purpose of the DTLS cookie is to prevent blind resource
> consumption DoS attacks, and ICE inherently that you're not going
> to be doing handshakes with random remote IP addresses, I don't
> think there's much of an issue here.
> 
> -Ekr
>