Subject: RE: [MMUSIC] RTP denial of service

From: Thomas Zeng <[email-masked]>
Date: Fri, 11 Jul 2003 11:24:05 -0700

Jonathan:

Thanks for this timely work. I finally got a chance to review it, along with
the email trail.

Magnus asked a good question: doesn't STUN (RFC3489) require TLS ? See
section 9.2:
   In order to ensure interoperability, this
   specification describes a TLS-based mechanism.  This mechanism,
   described in this section, MUST be implemented by clients and
   servers.

I suspect that some RTSP thin clients (those embedded in low-power devices)
may not have enough resources (CPU and/or bandwidth) to run TLS... at the
minimal, it adds more work to implementors of RTSP.

Now, in section 5 of:
http://www.ietf.org/internet-drafts/draft-rosenberg-mmusic-rtp-denialofservi
ce-00.txt

You seem to imply that RTSP already follows Offer/Answer exchanges? I'd like
to hear more on this subject...

Thanks,
- thomas
-----Original Message-----
From: Jonathan Rosenberg [mailto:[email-masked]]
Sent: Tuesday, July 01, 2003 10:16 PM
To: [email-masked]
Subject: [MMUSIC] RTP denial of service

Folks,

I'd like to draw your attention to the following I-D that I submitted 
recently:

http://www.ietf.org/internet-drafts/draft-rosenberg-mmusic-rtp-denialofservi
ce-00.txt

This draft describes a denial-of-service attack using RTP. This attack 
can be launched using any protocol that uses an offer/answer-like SDP 
exchange, including SIP and RTSP. The draft also discusses ICE as a 
solution to the problem.

Comments welcome.

Thanks,
Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
Chief Technology Officer                    Parsippany, NJ 07054-2711
dynamicsoft
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
mmusic mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mmusic

_______________________________________________
mmusic mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mmusic

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 16 Jul 2003 18:45:43 -0400

Sorry for the delay in responding. Responses inline.

>    described in this section, MUST be implemented by clients and

TLS is not needed in the peer-to-peer usage. Thats because there is an 
alternate mechanism being used for obtaining the shared secret - 
namely the signaling protocol, which has its own security mechanisms.

The words above are aimed at the case where the client is contacting a 
public server. There, yes it is needed.

> minimal, it adds more work to implementors of RTSP.

I would imagine TLS would be there for other reasons.

> to hear more on this subject...

No, clearly it doesn't. I'm being loose with my terms here. It follows 
an offer-answer like exchange in that there are two entities, and both 
tell each other IP addresses.

-Jonathan R.