Subject: [MMUSIC] Updates to BUNDLE "Security Considerations"

From: Suhas Nandakumar <[email-masked]>
Date: Tue, 22 Nov 2016 13:50:16 +0530

Hello Bundle Authors

   As part of discussions on the Stephen Farrell's "COMMENT" on the SDP Mux
Draft during IESG Evaluation, there was a  proposal made to update the
Security Considerations section of the BUNDLE draft to address security
concern raised by Stephen.

The issue:
   When using a=crypto (TRANSPORT category) attribute across media
sections, the Offer/Answer negotiation MAY end up in selecting a media
section with a weaker a=crypto line.

The Proposal (from Cullen):

 So here my straw man suggestion ... it seems like the right place to
> mention this is in the security consideration for bundle and point
> out that if you offer multiple m-lines that are bundled, the
> recommendation is for the offers and answers to have the same security
> level or put the m-line with the highest level security first so that
> if bundle is selected, we get the strongest security.

Full discussion can be found here:
 https://www.ietf.org/mail-archive/web/mmusic/current/msg17184.html

Thanks
Suhas

---

From: Christer Holmberg <[email-masked]>
Date: Tue, 22 Nov 2016 08:26:31 +0000

Hi,

When you say “put the m-line first” I assume you mean first in the group:BUNDLE attribute list?

Regards,

Christer

From: Suhas Nandakumar <[email-masked]<mailto:[email-masked]>>
Date: Tuesday 22 November 2016 at 11:20
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Updates to BUNDLE "Security Considerations"
Resent-From: <[email-masked]<mailto:[email-masked]>>
Resent-To: Christer Holmberg <[email-masked]<mailto:[email-masked]>>, Harald Alvestrand <[email-masked]<mailto:[email-masked]>>, Cullen Jennings <[email-masked]<mailto:[email-masked]>>
Resent-Date: Tuesday 22 November 2016 at 11:20

Hello Bundle Authors

   As part of discussions on the Stephen Farrell's "COMMENT" on the SDP Mux Draft during IESG Evaluation, there was a  proposal made to update the Security Considerations section of the BUNDLE draft to address security concern raised by Stephen.

The issue:
   When using a=crypto (TRANSPORT category) attribute across media sections, the Offer/Answer negotiation MAY end up in selecting a media section with a weaker a=crypto line.

Thanks
Suhas

---

From: Suhas Nandakumar <[email-masked]>
Date: Tue, 22 Nov 2016 14:25:00 +0530

Hello Christer

  That's right - first in the a=group:BUNDLE list.

Thanks
Suhas

On Tue, Nov 22, 2016 at 1:56 PM, Christer Holmberg <
[email-masked]> wrote:

> From: Suhas Nandakumar <[email-masked]>
> To: "[email-masked]" <
> [email-masked]>
> Cc: "[email-masked]" <[email-masked]>
> Resent-From: <[email-masked]>
> Resent-To: Christer Holmberg <[email-masked]>, Harald
> Alvestrand <[email-masked]>, Cullen Jennings <[email-masked]>
>    As part of discussions on the Stephen Farrell's "COMMENT" on the SDP
> Mux Draft during IESG Evaluation, there was a  proposal made to update the