Subject: [AVT] RE: Comments on draft-ietf-avt-rtp-vc1-02

From: "Anders Klemets" <[email-masked]>
Date: Thu, 8 Dec 2005 21:13:46 -0800

>>>T1. Will it be possible to carry any type of active content (like 
>>>scripts or Java code) in the VC-1 user data? If that is the case
there
>>
>Yes, sorry, I meant RFC 3640 that contains such paragraphs in its 
>security consideration section.

I can understand that RFC 3640 needs to discuss security, because
MPEG-J, BIFS, etc., are part of the MPEG-4 spec itself.  The VC-1
user-data, on the other hand, is registered separately by SMPTE.  

VC-1 user-data is actually identical to the MPEG-2 user-data.  And RFC
2250 (MPEG-2 RTP Payload Format) doesn't mention user-data as a security
risk.

In my opinion, putting a warning about user-data is a little bit like
putting a warning against downloading binaries in the HTTP spec, or
putting a warning about telemarketer scams in the SIP spec. :-)

Nevertheless, I have written the following paragraph, to be added to the
VC-1 security considerations section:

"VC-1 bit streams can carry user-data, such as closed captioning
information and content meta-data.  VC-1 requires identifiers for
user-data to be registered with SMPTE.  Depending on the type of
user-data, it might be possible for a sender to generate user-data in a
non-compliant manner to crash the receiver or make it temporarily
unavailable.  Senders that transport VC-1 bit streams SHOULD ensure that
the user-data is compliant with the specification registered with SMPTE
(see Annex F of [1].)  Receivers should prevent malfunction in case of
non-compliant user-data."

Does it look OK?

Anders

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt

---

From: Magnus Westerlund <[email-masked]>
Date: Fri, 09 Dec 2005 10:43:49 +0100

> 2250 (MPEG-2 RTP Payload Format) doesn't mention user-data as a security

Okay, does MPEG-2 user data allow scripting or other active content? If 
that is the case I would like to have warning about also that, similar 
to the last paragraph in section 5 of RFC 3640.

That RFC 2250 lacks this is of course not good, but hardly surprising. 
We have gather quite a lot of experience since 1998. Also we are raising 
the bar for our standard tracks RTP payload formats in all regards.

> non-compliant user-data."

I think you should use upper case SHOULD also in the last sentence. In 
addition we need to know if MPEG2 user data may contain active content 
to determine if also that needs to be included.

Cheers

Magnus Westerlund

Multimedia Technologies, Ericsson Research EAB/TVA/A
----------------------------------------------------------------------
Ericsson AB                | Phone +46 8 4048287
Torshamsgatan 23           | Fax   +46 8 7575550
S-164 80 Stockholm, Sweden | mailto: [email-masked]

---

From: [email-masked]
Date: Fri, 9 Dec 2005 13:37:37 +0100 (CET)

MPEG-2 user data can contain any byte stream, and it's entierly up to the
receiver what to do with it (i.e. throwing it away, executing it, ...). 
Acyive content is allowed in MPEG-2 user data.

I'm unaware of any use of MPEG-2 user data in a way that would warrant the
term "active content", though.  User data has been used for mechanisms
such as close captioning, key transmission, and non-compliant vendor
specific standard enhancements.  The most important application in use (as
far as I know) is operator differentiation: a box purchased from operator
x will not work in the network of operator y.

Regards,
Stephan