Re: [secdir] secdir review of draft-ietf-siprec-metadata-20

[David Mandelberg <[e-mail]>]

On 02/15/2016 10:31 AM, Ram Mohan R (rmohanr) wrote:
> I agree with all of Paul's responses. One more point to add to Paul¹s
> response-
> 1) If two SRCs use the same UUID  (because they intentionally
> choose to do so ) it MUST retain the UUID/object mapping. In
> other words, if UUID 1 was referring ³participant-1" object in RS1 by
> SRC1, the same UUID1 can be used by other SRCs to only refer
> Participant-1 and not any other objects.
> 
> If it was not clear from the draft we can add a line in draft to the
> effect of - " If multiple SRCs use
> the same UUID it MUST ensure a UUID is always mapped to same object across
> all Recording Sessions".

It was clear to me that this was the intent. My question was about what
happens when a single malicious SRC violates this by introducing a new
object with an existing UUID. I don't think the draft specifies how the
SRS behaves in this case, nor does it say anything to prevent a
malicious SRC from being able to do this.

> 
> Regards,
> Ram

-- 
David Eric Mandelberg / dseomn
http://david.mandelberg.org/