Subject: Re: [MMUSIC] Draft new version: draft-ietf-mmusic-udptl-dtls-01

From: Christer Holmberg <[email-masked]>
Date: Mon, 2 Dec 2013 19:44:21 +0000

Hi Oscar,

In section 3.1, I suggest to modify/replace the third, fourth and fifth bullets with the 2 following bullets:

	"o  If the endpoint supports, and is willing to use, a ciphersuite with an associated certificate,
  	     it MUST include an SDP fingerprint attribute [RFC4572] in the SDP.

	o  If a ciphersuite with an associated certificate is selected during the DTLS handshake, the certificate 
	   received during the DTLS handshake MUST match the fingerprint
	   received in the SDP fingerprint attribute. If the fingerprint
	   does not match the hashed certificate, then the endpoint MUST tear
	   down the media session immediately. Note that it is permissible
	   to wait until the other side's fingerprint has been received
	   before establishing the connection; however, this may have
	   undesirable latency effects."

Regards,

Christer

-----Alkuperäinen viesti-----
Lähettäjä: Oscar Ohlsson 
Lähetetty: 22. marraskuuta 2013 11:19
Vastaanottaja: Christer Holmberg; [email-masked]
Aihe: RE: Draft new version: draft-ietf-mmusic-udptl-dtls-01

Hi,

I have a comment on the usage of the fingerprint attribute in draft-ietf-mmusic-udptl-dtls-01. In future versions of 3GPP TS 33.328 we would like to use UDPTL-DTLS in combination with MIKEY-TICKET.  In that case there is no exchange of certificate fingerprints; instead the offerer and answerer negotiates a secret key over SDP and then runs a DTLS-PSK handshake. The problem is that draft-ietf-mmusic-udptl-dtls-01 currently forbids other types of key management protocols:

   o  The certificate presented during the DTLS handshake MUST match the
      fingerprint exchanged via the signaling path in the SDP.

   o  If the fingerprint does not match the hashed certificate, then the
      endpoint MUST tear down the media session immediately.  Note that
      it is permissible to wait until the other side's fingerprint has
      been received before establishing the connection; however, this
      may have undesirable latency effects.

I would suggest that you make the requirements related to certificate fingerprints conditional, e.g. by adding a statement similar to this:

   In case DTLS is used with a pre-shared key ciphersuite (RFC 4279) the requirements related to certificate verification 
   and inclusion of certificate fingerprints do not apply. How the pre-shared key is made available to the endpoints 
   is out of scope of this specification. 

Regards,

Oscar Ohlsson

From: mmusic [mailto:[email-masked]] On Behalf Of Christer Holmberg
Sent: den 21 november 2013 09:15
To: [email-masked]
Subject: [MMUSIC] Draft new version: draft-ietf-mmusic-udptl-dtls-01

Hi fax lovers,

We've submitted a new version (-01) of draft-ietf-mmusic-udptl-dtls.

CHANGES:

In addition to some editorial fixes, the changes, based on e-mail discussions, are:

- SDP offerer is allowed to assign an a=setup:active or a=setup:passive value, in addition to the recommended a=setup:actpass 
- The example for secure fax replacing audio stream in audio-only session added 
- Editor's note on the connection attribute resolved by prohibiting usage of the SDP connection attribute 

OPEN ISSUES:

There is still an open issue in section 4.2, which is more editorial than technical. Comments and input is welcome.

Regards,

Christer

---

From: Oscar Ohlsson <[email-masked]>
Date: Tue, 3 Dec 2013 09:22:06 +0000

Hi Christer

I'm fine with your proposal.

Regards,

Oscar

-----Original Message-----
From: Christer Holmberg 
Sent: den 2 december 2013 20:44
To: Oscar Ohlsson; [email-masked]
Subject: VS: Draft new version: draft-ietf-mmusic-udptl-dtls-01

Hi Oscar,

Regards,

Christer

-----Alkuperäinen viesti-----
Lähettäjä: Oscar Ohlsson 
Lähetetty: 22. marraskuuta 2013 11:19
Vastaanottaja: Christer Holmberg; [email-masked]
Aihe: RE: Draft new version: draft-ietf-mmusic-udptl-dtls-01

Hi,

Regards,

Oscar Ohlsson

Hi fax lovers,

CHANGES:

OPEN ISSUES:

Regards,

Christer