Subject: [MMUSIC] Should we have ICE TCP lite?

From: Ari Keranen <[email-masked]>
Date: Fri, 17 Dec 2010 17:56:42 +0200

Folks,

Another issue that Hadriel raised was that the current approach of using 
RFC4145 (co-media) instead of ICE lite for TCP does not help with IPv6 
transition with dual stack since you can't give more than one address 
for a media component with co-media. Also, if you don't send any 
connectivity checks, there's a chance for someone hijacking the media 
connection (although two lite implementations connecting with each other 
would not send checks either).

I would assume ICE lite could work by the lite agents including only 
passive candidates, and if both are lite, the controlling agent selects 
the pair to use and sends updating SDP with co-media "a=setup:active" 
while the controlled agent would respond with "a=setup:passive" and the 
connection would be created accordingly. This seems to be fairly simple 
both specification and implementation-wise.

The current decision to use RFC4145 was made after IETF 70; see minutes 
at [1], and related list discussion at [2].

The question is, do we want to revert that decision and define ICE lite 
for TCP, or should we stick with only co-media?

Cheers,
Ari

[1] http://www.ietf.org/proceedings/70/minutes/mmusic.html
[2] http://www.ietf.org/mail-archive/web/mmusic/current/msg06663.html

---

From: Simon Perreault <[email-masked]>
Date: Fri, 17 Dec 2010 11:27:28 -0500

On 2010-12-17 10:56, Ari Keranen wrote:
> the current approach of using
> transition with dual stack

IMHO, this is an important problem.

> if you don't send any
> connection

IMHO, this is not an important problem. ICE's raison d'être is not security.

> for TCP, or should we stick with only co-media?

We need something that enables transition to IPv6. It looks like
co-media does not do that, while ICE TCP Lite would. The choice seems
easy to me.

Simon
-- 
DTN made easy, lean, and smart --> http://postellation.viagenie.ca
NAT64/DNS64 open-source        --> http://ecdysis.viagenie.ca
STUN/TURN server               --> http://numb.viagenie.ca

---

From: Ari Keranen <[email-masked]>
Date: Mon, 20 Dec 2010 17:02:14 +0200

> IMHO, this is an important problem.

Yes, and since ICE seems to be the tool of choice for v4/v6 negotiation, 
it would be natural to use it here too.

> IMHO, this is not an important problem. ICE's raison d'être is not security.

And using media security should make the hijacking attacks futile anyway.

> co-media does not do that, while ICE TCP Lite would. The choice seems

The usual counter-argument here is that full ICE enables transition, and 
that's what you should do anyway.

That said, I do still see benefit in the lite mode since if both are 
lite, you don't do checks at all and save 1 or 2 RTTs (one connectivity 
check and one nomination check; or only one check if ICE's aggressive 
mode is used). This seems to be important to many folks who have 
scenarios where you "always know" you're not behind a nasty middlebox.

It would be interesting to get comments from the folks who were part of 
the discussions when the choice to discard ICE lite was originally made. 
Anyone?

Cheers,
Ari