Subject: [MMUSIC] RTSP session identifiers

From: Joe Pallas <[email-masked]>
Date: Thu, 10 Aug 2006 15:54:56 -0700

Are the requirements in section 3.3 on session identifiers really  
justifiable?  This seems to be a case where "hard to guess" is being  
used as a substitute for real security.

> 3.3 Session Identifiers
>
>    Session identifiers are strings of any arbitrary length. A session
>    identifier MUST be chosen randomly and MUST be at least eight
>    characters long to make guessing it more difficult. (See Section  
> 20.)

I ask because I just encountered a client that decided to reject  
session identifiers less than 8 characters long.  (Thank heavens it  
didn't also impose its own test for randomness.)  It certainly isn't  
the client's place to enforce this requirement, but that's not really  
my point.

My point is that randomness is used in communication protocols to  
reduce the likelihood of accidental collisions, not to provide  
security.  These requirements are either inappropriate,  or  
inadequate, as it says in section 20:

>         Session hijacking: Since there is no or little relation  
> between
>              a transport layer connection and an RTSP session, it is
>              possible for a malicious client to issue requests with
>              random session identifiers which would affect  
> unsuspecting
>              clients. The server SHOULD use a large, random and non-
>              sequential session identifier to minimize the possibility
>              of this kind of attack. For real session security, client
>              authentication needs to be performed.

Imposing these requirements on the server's choice of session  
identifier doesn't actually make the protocol more secure, but it  
does give a possibly dangerous illusion of such.  I would suggest  
that the requirements be removed, or softened to SHOULD, accompanied  
by some text that explains that they don't actually provide any true  
security.

joe

_______________________________________________
mmusic mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mmusic