Re: [Sipbrandy] WGLC: draft-ietf-sipbrandy-osrtp-04 - Christer's review

[Andy Hutton <[e-mail]>]

On 24 May 2018 at 14:11, Christer Holmberg
<[e-mail]> wrote:
> Hi,
>
>>>>>Has there been discussions on whether the subsequent offer really is
>>>>>the same?
>>>>
>>>> Not sure whether this has been discussed explicitly with regard to
>>>>this draft.
>>>
>>> Where has it been discussed? The MMUSIC draft doesn't say anything
>>>about subsequent offers either.
>>>
>>>>> For example, if the initial O/A has resulted in SAVP, would you still
>>>>>use AVP in a subsequent offer?
>>>>
>>>> Yes the recommendation would be to use AVP in a subsequent offer
>>>>otherwise things can go wrong when you consider things like 3PCC etc.
>>>
>>> What if the answerer, who included SAVP in the initial answer, sends a
>>>subsequent offer? Will it keep SAVP in that offer, or will it switch to
>>>AVP?
>>>
>>
>>This really depends on the preferences of the answerer as to whether
>>it requires SRTP or is willing to try OSRTP it is the same
>>considerations as made when sending the initial offer.
>
>
> So, that endpoint is allowed to require SRTP, but the endpoint that sent
> the initial offer must try OSRTP if it sends a subsequent offer???
>

The rules or probably more accurately the recommendations for both
endpoints are exactly the same in that when creating an offer the
decision on whether to try OSRTP or not depends on their own
preferences. This is true for both the initial offer and any
subsequent offers.


> I think the rules for subsequent offers shall be the same for both
> endpoints, i.e., either shall both endpoints be allowed to ³require² SRTP
> in a subsequent offer, OR both endpoints must try OSRTP in a subsequent
> offer.
>

As above the rules/recommendations for both endpoints are the same and
are dependent on their own preferences. If the endpoint is willing to
try OSRTP then it should do so in the subsequent offer for maximum
chance of interoperability but if its requires SRTP then it would not
make an OSRTP offer.

> In addition, if security was NOT negotiated in the in the initial o/a
> exchange, then I guess each endpoint can choose whether to use OSRTP or
> not in subsequent offers?
>

Absolutely yes.


> Regards,
>
> Christer
>
>