Subject: [clue] Security issue - DTLS/SRTP SHOULD or MUST be supported

From: "Roni Even" <[email-masked]>
Date: Mon, 20 Jul 2015 10:04:32 +0300

Hi,

In the last IETF meeting when talking about the signaling document there was
a hum to use SHOULD and not MUST be supported for DTLS/SRTP

The issue of SHOULD or MUST was raised now for the framework in the AD
review.

It is clear that we MUST have security for CLUE controlled m-lines and I
assume that people where looking at RFC7202 when thinking about SHOULD or
MUST

We need to have good text that will say why we say SHOULD be supported and
not MUST be supported.

My personal view here (not as a chair)  is that since CLUE is about an
interoperability profile and not just a general protocol to be used by other
foras we need to have a security interoperability point and if we say SHOULD
be supported we do not have one. Note that saying MUST be supported does not
mean that it MUST be used in cases where other means are there as explained
in RFC7202

In IETF92 notes it says

Christer: What was the reason for mandating the DTLS. Is it mandatory to
support, mandatory to use?

Rob Hansen: DTLS was made mandatory to use to avoid video hammer attack and
as general increased security - we had a hum in IETF91. we had explanations
in -04 and when we discussed this in -05 room wanted it to be mandatory to
use

Christer: Proposing that there is no specific reason to make this mandatory.

Stefan Wenger: That is only one interpretation.

Richard Barnes: Default for new stuff needs to be security. Obviously "must
support" as that is the secure mode. Need discussion of what else might be
used.

Mark Duckworth: Also had same discussion regarding security in the framework
document. There says "must support" rather than "must use".

Chairs: Seem to be heading towards "must support" only.

Steven Botzko: Proposed only recommended to support.

Discussion will continue on the list. Chairs take action to start this
discussion.

Sorry for not doing it earlier but please provide input. Note that this
issue is relevant also to the framework and RTP mapping

Thanks

Roni Even

CLUE co-chair

---

From: Christian Groves <[email-masked]>
Date: Tue, 21 Jul 2015 11:09:50 +1000

Hello Roni,

I'm a little confused. What are you asking for? You mention we need text 
to describe that DTLS/SRTP SHOULD be supported but then you seem to 
argue for MUST be supported. Did you want to re-open the discussion or?

Regards, Christian

On 20/07/2015 5:04 PM, Roni Even wrote:
>
> Hi,
>
> In the last IETF meeting when talking about the signaling document 
> there was a hum to use SHOULD and not MUST be supported for DTLS/SRTP
>
> It is clear that we MUST have security for CLUE controlled m-lines and 
> I assume that people where looking at RFC7202 when thinking about 
> SHOULD or MUST
>
> We need to have good text that will say why we say SHOULD be supported 
> and not MUST be supported.
>
> interoperability profile and not just a general protocol to be used by 
> other foras we need to have a security interoperability point and if 
> we say SHOULD be supported we do not have one. Note that saying MUST 
> be supported does not mean that it MUST be used in cases where other 
> means are there as explained in RFC7202
>
> In IETF92 notes it says
>
> Christer: What was the reason for mandating the DTLS. Is it mandatory 
> to support, mandatory to use?
>
> Rob Hansen: DTLS was made mandatory to use to avoid video hammer 
> attack and as general increased security - we had a hum in IETF91. we 
> had explanations in -04 and when we discussed this in -05 room wanted 
> it to be mandatory to use
>
> Richard Barnes: Default for new stuff needs to be security. Obviously 
> "must support" as that is the secure mode. Need discussion of what 
> else might be used.
>
> Mark Duckworth: Also had same discussion regarding security in the 
> framework document. There says "must support" rather than "must use".
>
> Sorry for not doing it earlier but please provide input. Note that 
> this issue is relevant also to the framework and RTP mapping
>
> Thanks
>
> Roni Even
>
> CLUE co-chair
>
>
>
> _______________________________________________
> clue mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/clue

---

From: Roni Even <[email-masked]>
Date: Tue, 21 Jul 2015 07:23:52 +0000

Hi Christian,
We discussed the issue in the CLUE session and I will follow with a specific mail to the list.
One important issue is that the security MUST be consistent between all CLUE doucments and the framework currently says MUST be supported.
I will send proposed text tp be used in all doucments to the list
Roni 

________________________________________
From: clue [[email-masked]] on behalf of Christian Groves [[email-masked]]
Sent: Tuesday, July 21, 2015 4:09 AM
To: [email-masked]
Subject: Re: [clue] Security issue - DTLS/SRTP SHOULD or MUST be supported

Hello Roni,

Regards, Christian