Subject: [MMUSIC] Where to apply encryption?

From: [email-masked] (Dale R. Worley)
Date: Wed, 27 Feb 2013 16:58:06 -0500 (EST)

Current bundling proposals seem to expect that the packets on the wire
will be either SRTP/SRTCP or SCTP-within-DTLS.  Of course, this
provides encryption of the carried media.

But it seems to me that it would be more straightforward to multiplex
RTP/RTCP and SCTP packets, and than as a lower layer, have one DTLS
association that encrypts all of those packets indifferently.  It
would also provide privacy regarding the number and types of the
bundled media streams.

But my knowledge of crypto is thin, and maybe there's a reason that
using one DTLS association to encrypt the multiplexed packet stream
wouldn't work as well.

Dale

---

From: Martin Thomson <[email-masked]>
Date: Wed, 27 Feb 2013 14:11:21 -0800

There are no security reasons why this wouldn't work.  Some
applications already do this.

The actual problems are manifold:

 - SRTP was designed to have a low per-packet overhead.  The DTLS
record layer has a larger per-packet overhead.
 - SRTP exposes certain attributes in clear text for intermediaries to
use.  Intentionally.  Using DTLS would lose this.
 - SRTP enjoys wide support.  This would harm interoperability with
existing communication devices, forcing the use of more complex
gateways.

--Martin

On 27 February 2013 13:58, Dale R. Worley <[email-masked]> wrote:
> _______________________________________________
> mmusic mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mmusic

---

From: Richard Barnes <[email-masked]>
Date: Wed, 27 Feb 2013 17:38:06 -0500

Yes.  Back in the days of the ZRTP / DTLS wars, the possibility of just
using DTLS was discussed, but morphed into DTLS-SRTP for the reasons Martin
describes.

On Wednesday, February 27, 2013, Martin Thomson wrote:

> On 27 February 2013 13:58, Dale R. Worley <[email-masked]<javascript:;>>
> wrote:
> > [email-masked] <javascript:;>
> [email-masked] <javascript:;>

---

From: "Dan Wing" <[email-masked]>
Date: Thu, 28 Feb 2013 14:51:52 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Dale R. Worley
> Sent: Wednesday, February 27, 2013 1:58 PM
> To: [email-masked]
> Subject: [MMUSIC] Where to apply encryption?
> 
> will be either SRTP/SRTCP or SCTP-within-DTLS.  Of course, this provides
> encryption of the carried media.
> 
> association that encrypts all of those packets indifferently.  It would
> also provide privacy regarding the number and types of the bundled media
> streams.

SRTP (RFC3711) was carefully and purposefully designed so the RTP header 
remains in the clear, and DTLS-SRTP was also purposefully designed so
after the DTLS-SRTP handshake establishes the SRTP keys, the SRTP packets
flow over the wire exactly like they would for any other keying 
mechanism (ZRTP, MIKEY-*, Security Descriptions).

By sending SRTP packets with their RTP header in the clear, it allows:
  * the RTP header to be compressed (cRTP [RFC2508], ECRTP [RFC3545])
  * analysis devices to see where, on a network path, SRTP packets 
    are lost, delayed, or get mis-ordered.
  * analysis devices to see SRTCP receiver reports and sender reports,
    which are typically authenticated but in the clear.

> using one DTLS association to encrypt the multiplexed packet stream

-d