Subject: [Rum] Magnus Westerlund's Block on charter-ietf-rum-00-02: (with BLOCK)

From: Magnus Westerlund via Datatracker <[email-masked]>
Date: Wed, 10 Apr 2019 06:39:56 -0700

Magnus Westerlund has entered the following ballot position for
charter-ietf-rum-00-02: Block

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/charter-ietf-rum/

----------------------------------------------------------------------
BLOCK:
----------------------------------------------------------------------

Why are the no discussion of security mechanism being part of the profile?
Considering that the profile includes the media plane, I assume at least
mandatory to implement media protection security mechansism and what ciphers
should be defined. Then is the of the key-management and its tie into the
establishment signalling. I understand that one want to establisha  a border
for what is in scope and out of scope. But as I read the charter now it is
completely missing.

All that I find are this part:
 The working group will consider issues related to authentication of the
parties involved in the video relay call. No protocol changes are anticipated
by this work.

This sounds like actually discusssing the security model. It is possible to be
more explicit of how one handle the fact that one have three parties, where
only one part talks to both.

---

From: Brian Rosen <[email-masked]>
Date: Wed, 10 Apr 2019 10:31:02 -0400

The profile will most certainly include all the best practice security mechanisms for SIP.  The charter discusses using the most up to date media plane recommendations, which are the WebRTC recommendations, including DTLS-SRTP, and we will require TLS in the signaling plane.   As these are UAs, and not proxy servers, the usual security mechanisms for registration will be required.  We certainly don’t plan to innovate other than exploring the issues raised of explicit man-in-the-middle, but we will require all implementations to maintain current best practice on security mechanisms.  We’ll craft some language to include in the charter.  

Maybe: The profile will specify current best practice security mechanisms for SIP based end devices as mandatory to implement

> On Apr 10, 2019, at 9:39 AM, Magnus Westerlund via Datatracker <[email-masked]> wrote:
>

---

From: Adam Roach <[email-masked]>
Date: Wed, 10 Apr 2019 12:26:59 -0500

I've added: "The profile will require best-practice security mechanisms 
for SIP-based end devices."

/a

---

From: Magnus Westerlund <[email-masked]>
Date: Thu, 11 Apr 2019 07:50:33 +0000

Thanks,

Have cleared.

Cheers

Magnus

-- 

Magnus Westerlund 

----------------------------------------------------------------------
Network Architecture & Protocols, Ericsson Research
----------------------------------------------------------------------
Ericsson AB                 | Phone  +46 10 7148287
Torshamnsgatan 23           | Mobile +46 73 0949079
SE-164 80 Stockholm, Sweden | mailto: [email-masked]
----------------------------------------------------------------------

---

From: "Olle E. Johansson" <[email-masked]>
Date: Thu, 11 Apr 2019 10:21:21 +0200

> On 10 Apr 2019, at 19:26, Adam Roach <[email-masked]> wrote:
> 
> I've added: "The profile will require best-practice security mechanisms for SIP-based end devices.”
And where do we have a definition of “best-practice security mechanisms for SIP” ?

There’s a lot of issues to take care of before we can practice security in SIP… 

/O

---

From: Adam Roach <[email-masked]>
Date: Thu, 11 Apr 2019 10:56:18 -0500

On 4/11/19 3:21 AM, Olle E. Johansson wrote:
>
>
>> On 10 Apr 2019, at 19:26, Adam Roach <[email-masked] 
>> <mailto:[email-masked]>> wrote:
>>

This is certainly a topic I would expect the working group to spend 
considerable time discussing. The goal of a charter is to steer and 
constrain work, not to actually perform the work; and to answer your 
question in the charter would require us to do the work of the working 
group before chartering the working group.

/a