Subject: Re: [MMUSIC] Bundling data channel and RTP? - Text proposal - Second try

From: Christer Holmberg <[email-masked]>
Date: Fri, 12 Jun 2015 11:54:49 +0000

Hi,

Based on the input from people, I suggest the following text for the new 'DTLS Considerations' section:

-------------

12.  DTLS Considerations

   One or more media streams within a BUNDLE group might use the
   Datagram Transport Layer Security (DTLS) protocol [RFC6347] in order
   to encrypt the data, or to negotiate encryption keys if another
   encryption mechanism is used to encrypt media.

   When DTLS is used within a BUNDLE group, the following rules apply:

   o  There can only be one DTLS association [RFC6347] associated with
      the BUNDLE group;

   o  Each usage of the DTLS association within the BUNDLE group MUST
      use the same mechanism for determining which endpoints (the
      offerer or answerer) becomes DTLS client and DTLS server; and

   o  If the DTLS client supports DTLS-SRTP [RFC5764] it MUST include
      the 'use_srtp' extension [RFC5764] in the DTLS ClientHello message
      [RFC5764], The client MUST include the extension even if the usage
      of DTLS-SRTP is not negotiated as part of the session.

   NOTE: The inclusion of the 'use_srtp' extension during the initial
   DTLS handshake ensures that a DTLS renegotiation will not be required
   in order to include the extension, in case DTLS-SRTP encrypted media
   is added to the BUNDLE group later during the session.

------------

Regards,

Christer

-----Original Message-----
From: mmusic [mailto:[email-masked]] On Behalf Of Christer Holmberg
Sent: 31. toukokuuta 2015 10:03
To: Roman Shpount
Cc: [email-masked]; [email-masked]
Subject: Re: [MMUSIC] Bundling data channel and RTP? - Text proposal

Hi,

>>> I would suggest "use_srtp" extension must always be enabled for DTLS session used in bundle.
>>
>> Assuming SRTP is supported, I assume. If a node doesn't support SRTP 
>> to begin with, or if an application is never going to offer (or 
>> accept if offered) SRTP, I guess there is no reason to mandate "use_srtp".
>>
>> Now, there are statements in RFC 5764 saying e.g.:
>>
>>       "This extension MUST only be used when the data being transported is RTP or RTCP [RFC3550]."
>>
>> That of course makes sense for a non-BUNDLE DTLS connection, but I 
>> wonder whether we somehow explicitly need to say that it doesn't apply for BUNDLE?
>
> Another big question how would current browser implementations handle 
> a DTLS connection without "use_srtp" extension. I have a strong 
> suspicion that DTLS session setup will fail without this extension present.
>
> I think, WebRTC enabled browsers currently export SRTP key material 
> during session setup even if no SRTP traffic is ever sent or received 
> by this connection and fail the entire connection if key export fails. 
> This, most likely, can be modified to only export SRTP key material 
> when SRTP session is actually created and defining some sort of fall 
> back procedure when a media track is actually added to a connection without "use_srtp" (either failure or require renegotiation with new transport).

Anyone from the browser community that can comment on this?

> To conclude, the group can either decide that all DTLS sessions in 
> bundle should be setup with "use_srtp" extension and keep the current 
> implementations working as they are currently coded, or allow not to include this extension and fix the implementations.

Currently, I am not aware of any scenarios where people would use BUNDLE without SRTP - or at least using clients that wouldn't support SRTP.

But, as the current trend seems to be to put more and more protocols on DTLS, I think one can assume that there will also be use-cases without SRTP in future.

Regards,

Christer

_______________________________________________
mmusic mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mmusic

---

From: "GUBALLA, JENS (JENS)" <[email-masked]>
Date: Mon, 15 Jun 2015 12:53:20 +0000

Hi Christer,

> From: Christer Holmberg [mailto:[email-masked]]
> Sent: Freitag, 12. Juni 2015 13:55
> To: mmusic
> Cc: [email-masked]; Roman Shpount; Christian Groves
> ([email-masked]); GUBALLA, JENS (JENS); Martin Thomson
> ([email-masked]); Makaraju, Maridi Raju (Raju); Justin Uberti
> ([email-masked])
> Subject: RE: [MMUSIC] Bundling data channel and RTP? - Text proposal - 
> Second
> try
>
> Hi,
>
> Based on the input from people, I suggest the following text for the new 
> 'DTLS
> Considerations' section:
>
> -------------
>
> 12.  DTLS Considerations
>
[JG] I prefer the term "DTLS connection" over "DTLS association" because
I am not aware that the latter term is defined anywhere in the scope of 
(D)TLS.
RFC6347 is using the terms "connection" and "association" interchangeably 
without
any definition. On the other hand the term "connection" is at least present
in the glossary section of RFC5246.

>       of DTLS-SRTP is not negotiated as part of the session.
[JG] I believe here "session" is referring to "SIP session", not to "DTLS 
session",
right? Should be explicitly stated in any case.

>    is added to the BUNDLE group later during the session.
[JG] "Session": Same comment as above.

Best regards,
Jens

> >>       "This extension MUST only be used when the data being transported 
> >> is
> RTP or RTCP [RFC3550]."
> >>
> >> wonder whether we somehow explicitly need to say that it doesn't apply 
> >> for
> BUNDLE?
> >
> > back procedure when a media track is actually added to a connection 
> > without
> "use_srtp" (either failure or require renegotiation with new transport).
>
> > implementations working as they are currently coded, or allow not to 
> > include
> this extension and fix the implementations.
>
> Currently, I am not aware of any scenarios where people would use BUNDLE
> without SRTP - or at least using clients that wouldn't support SRTP.
>
> But, as the current trend seems to be to put more and more protocols on 
> DTLS,
> I think one can assume that there will also be use-cases without SRTP in
> future.
>
> Regards,
>
> Christer
>

---

From: Christer Holmberg <[email-masked]>
Date: Mon, 15 Jun 2015 13:07:19 +0000

Hi Jens,

Thanks for your feeback! See inline.

> without any definition. On the other hand the term "connection" is at least 
> present

RFC 5763 and RFC 5764, both related to DTLS-SRTP, use "association":

	"We use the term "association" to refer to a particular DTLS cipher
   	suite and keying material set that is associated with a single host/
   	port quartet.  The same DTLS/TLS session can be used to establish the
   	keying material for multiple associations."   (RFC 5763)

	"Each DTLS-SRTP session contains a single DTLS association (called a
	"connection" in TLS jargon),..." (RFC 5764)

While I do realize that "connection" is not suitable for connectionless 
protocols, in my opinion it was
a mistake to use "association", because it has caused lots of confusion. I 
often get questions on what
the difference between a DTLS association and DTLS connection is :)

> session", right? Should be explicitly stated in any case.

See below.

> [JG] "Session": Same comment as above.

It's not DTLS, but it can of course be something else than SIP.

I guess we could say something like "multimedia session", "SDP session", or 
something...

Regards,

Christer

---

From: "Schwarz, Albrecht (Albrecht)" <[email-masked]>
Date: Mon, 15 Jun 2015 14:19:42 +0000

Hello Christer,

wrt

> While I do realize that "connection" is not suitable for connectionless protocols, in my opinion it was a mistake to use "association", because it has caused lots of confusion. I often get questions on what the difference between a DTLS association and DTLS connection is :)

1st) There is not any contradiction between "connection" and "connectionless" (according to the basic reference model for communicaions (X.200)).
Id est, a (N)-connection is either operated in communication mode (§ 5.3.3/X.200) "connection oriented" (= "connection mode" § 5.3.3.2/X.200) or "connectionless" (§ 5.3.3.3/X.200).
=> no contradiction ("there are connectionless (N)-connections ...")

2nd) DTLS as protocol belongs to category connection-oriented, not connectionless.
The (DTLS)-connection is of type connection-oriented.

Furthermore: that's the reason why there are also "UDP connections" despite their connectionless nature.

Regards,
Albrecht

-----Original Message-----
From: mmusic [mailto:[email-masked]] On Behalf Of Christer Holmberg
Sent: Montag, 15. Juni 2015 15:07
To: GUBALLA, JENS (JENS); mmusic
Cc: [email-masked]
Subject: Re: [MMUSIC] Bundling data channel and RTP? - Text proposal - Second try

Hi Jens,

> [JG] I prefer the term "DTLS connection" over "DTLS association" 
> because I am not aware that the latter term is defined anywhere in the 
> scope of (D)TLS.
> RFC6347 is using the terms "connection" and "association" 
> interchangeably without any definition. On the other hand the term 
> "connection" is at least present in the glossary section of RFC5246.

While I do realize that "connection" is not suitable for connectionless protocols, in my opinion it was a mistake to use "association", because it has caused lots of confusion. I often get questions on what the difference between a DTLS association and DTLS connection is :)

> [JG] I believe here "session" is referring to "SIP session", not to 
> "DTLS session", right? Should be explicitly stated in any case.

See below.

I guess we could say something like "multimedia session", "SDP session", or something...

Regards,

Christer

---

From: Christer Holmberg <[email-masked]>
Date: Mon, 15 Jun 2015 14:55:21 +0000

Hi Albrecht,

Whatever the reason, the fact is that DTLS - for whatever reason - chose to use "association" instead of "connection" :)

Regards,

Christer

-----Original Message-----
From: Schwarz, Albrecht (Albrecht) [mailto:[email-masked]] 
Sent: 15 June 2015 17:20
To: Christer Holmberg; GUBALLA, JENS (JENS); mmusic
Cc: [email-masked]
Subject: RE: [MMUSIC] Bundling data channel and RTP? - Text proposal - Second try

Hello Christer,

wrt

> While I do realize that "connection" is not suitable for 
> connectionless protocols, in my opinion it was a mistake to use 
> "association", because it has caused lots of confusion. I often get 
> questions on what the difference between a DTLS association and DTLS 
> connection is :)

Regards,
Albrecht

-----Original Message-----
From: mmusic [mailto:[email-masked]] On Behalf Of Christer Holmberg
Sent: Montag, 15. Juni 2015 15:07
To: GUBALLA, JENS (JENS); mmusic
Cc: [email-masked]
Subject: Re: [MMUSIC] Bundling data channel and RTP? - Text proposal - Second try

Hi Jens,

See below.

Regards,

Christer