Re: [rtcweb] Asking TLS for help with media isolation

Martin Thomson <martin.thomson@gmail.com> Mon, 07 April 2014 18:08 UTC

Return-Path: <martin.thomson@gmail.com>
X-Original-To: rtcweb@ietfa.amsl.com
Delivered-To: rtcweb@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6B7E91A01AE for <rtcweb@ietfa.amsl.com>; Mon, 7 Apr 2014 11:08:41 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WrE_EyigNkV9 for <rtcweb@ietfa.amsl.com>; Mon, 7 Apr 2014 11:08:35 -0700 (PDT)
Received: from mail-wi0-x22a.google.com (mail-wi0-x22a.google.com [IPv6:2a00:1450:400c:c05::22a]) by ietfa.amsl.com (Postfix) with ESMTP id 80B331A0267 for <rtcweb@ietf.org>; Mon, 7 Apr 2014 11:08:33 -0700 (PDT)
Received: by mail-wi0-f170.google.com with SMTP id bs8so6606661wib.3 for <rtcweb@ietf.org>; Mon, 07 Apr 2014 11:08:27 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=/B5UWfpArl37ZBrT9iV2i/IIAyNZoZi/0vUWpUgoEiw=; b=u+vkO0AK7MHWN5jPpYopb7qQpAT+ZEgF9baf5RZgwqGd/Y62ihWE3D2GPm0a0ospu/ D8Un7y1HmO42qkKlKxWJwNr31LWHr+oK6zsI2p0ziuguPIItjhbFYxQUZe3gCvOSzzno ffJPCWG7sr6NZz6gJY+l534CaalPc0Qyp+8H3l4o3gA7vdxIa5p3UWhSWDybr5VwI5wW t0qTEsC2boYsZleFdH2V5kEjbqBiCar+gvIhCm8oEDXe1Nu9Z4FEy2YyqJKqI7yz3Q4f Q7mCFSRmo6fCE7i85TDjsXpF6TvTPT0HviSlSjH5tMA9AzVMc9tWXG1CmgLSfkJZ2N1D tekw==
MIME-Version: 1.0
X-Received: by 10.180.185.197 with SMTP id fe5mr26998720wic.56.1396894107443; Mon, 07 Apr 2014 11:08:27 -0700 (PDT)
Received: by 10.227.147.10 with HTTP; Mon, 7 Apr 2014 11:08:27 -0700 (PDT)
In-Reply-To: <CAOW+2dvagpWtbZ2PF1MvLfk8YSkph_A9G6BJ_1KxvRggHGub3w@mail.gmail.com>
References: <CABkgnnWWuU63Vd=gw+wrh2ADgVYtQzhoRzRE1sv5azJE=MhWDg@mail.gmail.com> <CACsn0cmX55Eewak8GBxBbSFF3v7tRTVqRt0eLwkR2-Tk_V7gHA@mail.gmail.com> <CAOW+2dtKq4S68rNJAKbKbwMEnuD8rMbW4K_LfcjPBg5ps22BGw@mail.gmail.com> <CACsn0cnJcwjcn8GV1bv4z3=b6RTXKQ1X02Sj6ec-jNmrO9G=bg@mail.gmail.com> <CABkgnnUov2o+-NDL1Qcm_hVtOrvhuf=bM+drQdD+bWzFLK+DOw@mail.gmail.com> <CAOW+2dvagpWtbZ2PF1MvLfk8YSkph_A9G6BJ_1KxvRggHGub3w@mail.gmail.com>
Date: Mon, 7 Apr 2014 11:08:27 -0700
Message-ID: <CABkgnnWzzoMf_kQ8Jwmvw5optUmi9v7GTSJjvFxOadLqmsP_ng@mail.gmail.com>
From: Martin Thomson <martin.thomson@gmail.com>
To: Bernard Aboba <bernard.aboba@gmail.com>
Content-Type: text/plain; charset=UTF-8
Archived-At: http://mailarchive.ietf.org/arch/msg/rtcweb/ylnnuvDot6dEUzYQ5bP5jv8NGvE
Cc: "rtcweb@ietf.org" <rtcweb@ietf.org>
Subject: Re: [rtcweb] Asking TLS for help with media isolation
X-BeenThere: rtcweb@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <rtcweb.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/rtcweb/>
List-Post: <mailto:rtcweb@ietf.org>
List-Help: <mailto:rtcweb-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 07 Apr 2014 18:08:41 -0000

On 7 April 2014 11:00, Bernard Aboba <bernard.aboba@gmail.com> wrote:
> The implication here is that not only do media sharing the same DTLS session
> (e.g. audio and video multiplexed on the same port) share the "isolation"
> property, but even if audio and video are not multiplexed, if the same DTLS
> session is used by subsequent DTLS/SRTP sessions, then the "isolation"
> property is also shared.

The usual behaviour is to use the same 5-tuple for sending SRTP as the
one used for the DTLS handshake.  However, if the extracted keys from
the DTLS session is used to key different SRTP flows on other
5-tuples, then I suppose that the conditions attached to the DTLS
session would have to apply to those separate flows too.  That means
isolation, authentication, and whatever else we bind in.

I'm not sure that I'd do that, given the risks of things like SSRC
reuse, but maybe I'm misunderstanding the question.