Re: [Sframe] charter feedback

[Franziskus Kiefer <[e-mail]>]

Hi Alexandre,

thanks for the response.
I totally agree that the charter shouldn't restrict the use cases here.
Conferencing was really meant as an example (bad phrasing on my side,
though it's of course an important use case for us).
But the charter can set out the process taken by the WG. And all use cases
here should profit from this (i.e. making sure that the threat modeling and
solution for each use case are vetted by other parties, in particular
academia).

> Right now, emad is working on the conferencing use case with sergio, and
you might want to liaise with them on that specific topic. One document
about how SFrame can be used with RTP, and, seprately, with MLS including
the corresponding threat model is in progress. I think this is what you are
looking for.

I currently only know about https://github.com/eomara/sframe. Is there any
other draft in progress?

Best,
Franziskus


On Fri, 4 Sep 2020 at 13:23, Alexandre GOUAILLARD <
[e-mail]> wrote:

> Hi franz.,
>
> Thank you for your interest and the kind words.
>
> "Conferencing" is certainly a topic of interest, and i understand the
> focus of wire. SFrame can certainly be used in that context.
>
> However, there are other use cases than conferencing where media
> encryption is of interest, including but not limited to
> streaming/broadcasting and then of course all the hybrid use cases we start
> seeing emerging (watch parties, webinars, ....).
>
> We designed SFrame itself to refer ONLY to the media encryption part, and
> be as much as possible media transport agnostic, and use case/threat
> model/trust model agnostic, where the precedent attempt was extremely
> focussed on RTP-based conferencing.
>
> Eventually, each use case (e.g. conferencing) should have
> additional documents to come up to a full system whose properties could be
> verified, but we did not want to restrict the charter to a single use case.
>
> Right now, emad is working on the conferencing use case with sergio, and
> you might want to liaise with them on that specific topic. One document
> about how SFrame can be used with RTP, and, seprately, with MLS including
> the corresponding threat model is in progress. I think this is what you are
> looking for.
>
> In parallel, work is being done on application to SFrame for
> streaming/broadcasting and how it relates/overlaps with existing DRM
> solutions today in the bigger context. This will also hopefully have its
> own set of document. EVentually all would have the media encryption,
> SFrame, in common.
>
> Hope this helps.
>
>
>
> On Fri, Sep 4, 2020 at 6:23 PM Franziskus Kiefer <
> [e-mail]> wrote:
>
>> Hi all,
>>
>> First, thanks for working on this.
>> Wire is currently considering sframe for some use cases.
>>
>> Looking at the charter I noticed two things:
>>
>> The charter currently doesn't talk about authentication and to which
>> extent the WG wants to look at it. While authenticity might be implicit
>> through the used keys the sframe draft currently also uses signatures.
>>
>> I'm missing a statement about the process followed by the WG. End-to-end
>> encrypted conferencing is a relatively new topic without much research
>> around threat models. I therefore think that a process that validates the
>> threat model and the proposed solution is warranted. This might not have
>> the same extent as for TLS or MLS, but would still be good to have.
>>
>> Cheers,
>> Franziskus
>> --
>> Sframe mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/sframe
>>
>