Re: [Rum] Magnus Westerlund's Block on charter-ietf-rum-00-02: (with BLOCK)

[Adam Roach <[e-mail]>]

I've added: "The profile will require best-practice security mechanisms 
for SIP-based end devices."

/a

On 4/10/19 9:31 AM, Brian Rosen wrote:
> The profile will most certainly include all the best practice security mechanisms for SIP.  The charter discusses using the most up to date media plane recommendations, which are the WebRTC recommendations, including DTLS-SRTP, and we will require TLS in the signaling plane.   As these are UAs, and not proxy servers, the usual security mechanisms for registration will be required.  We certainly don’t plan to innovate other than exploring the issues raised of explicit man-in-the-middle, but we will require all implementations to maintain current best practice on security mechanisms.  We’ll craft some language to include in the charter.
>
> Maybe: The profile will specify current best practice security mechanisms for SIP based end devices as mandatory to implement
>
>
>
>> On Apr 10, 2019, at 9:39 AM, Magnus Westerlund via Datatracker <[e-mail]> wrote:
>>
>> Magnus Westerlund has entered the following ballot position for
>> charter-ietf-rum-00-02: Block
>>
>> When responding, please keep the subject line intact and reply to all
>> email addresses included in the To and CC lines. (Feel free to cut this
>> introductory paragraph, however.)
>>
>>
>>
>> The document, along with other ballot positions, can be found here:
>> https://datatracker.ietf.org/doc/charter-ietf-rum/
>>
>>
>>
>> ----------------------------------------------------------------------
>> BLOCK:
>> ----------------------------------------------------------------------
>>
>> Why are the no discussion of security mechanism being part of the profile?
>> Considering that the profile includes the media plane, I assume at least
>> mandatory to implement media protection security mechansism and what ciphers
>> should be defined. Then is the of the key-management and its tie into the
>> establishment signalling. I understand that one want to establisha  a border
>> for what is in scope and out of scope. But as I read the charter now it is
>> completely missing.
>>
>> All that I find are this part:
>> The working group will consider issues related to authentication of the
>> parties involved in the video relay call. No protocol changes are anticipated
>> by this work.
>>
>> This sounds like actually discusssing the security model. It is possible to be
>> more explicit of how one handle the fact that one have three parties, where
>> only one part talks to both.
>>
>>
>>
>>