Subject: [Sipping] SRTP Key Disclosure

From: "Dan Wing" <[email-masked]>
Date: Tue, 20 Nov 2007 23:17:57 -0800

Business requirements of some businesses require recording certain
phone calls.  For example, stock brokers, banks, mail-order catalog
companies, travel agencies, and so on, find it useful to record calls
with customers.  With PSTN gateways and RTP this is trivially 
accomplished today.  Tomorrow, where PSTN gateways are replaced
with SIP trunking, and SRTP is preferred over RTP (especially for
transactions with your bank, stockbroker, and doctor), this 
business need will become more difficult to meet.

To meet this need for recording SRTP-encrypted calls, we 
wrote "Disclosing Secure RTP (SRTP) Session Keys with a SIP 
Event Package", draft-wing-sipping-srtp-key-02, abstract:
   Many Secure RTP (SRTP) key exchange mechanisms do not disclose the
   SRTP session keys to intermediate SIP proxies.  However, these key
   exchange mechanisms cannot be used in environments where transcoding,
   monitoring, or call recording are needed.  This document specifies a
   secure mechanism for a cooperating endpoint to disclose its SRTP
   master keys to an authorized party.

If there is sufficient interest I would like to present
draft-wing-sipping-srtp-key-02 at the upcoming SIPPING meeting in Vancouver.

Comments welcome.

-d

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: [email-masked]
Date: Wed, 21 Nov 2007 08:26:18 -0500

Hi Dan, all, 

I have not read this in detail, and unclear if it represents a "right" 
approach or not, but I do believe the topic deserves discussion.  Since it 
is flagged -sipping- I assume that's the target WG, and it would not be 
presented elsewhere.  So, I would support a slice of time in SIPPING if it 
can be worked. 

-- Peter Blatherwick

"Dan Wing" <[email-masked]>
21.11.07 02:17
 
        To:     <[email-masked]>
        cc:     [email-masked], 'Francois Audet' <[email-masked]>, 
"'Fries,        Steffen'" <[email-masked]>
        Subject:        [Sipping] SRTP Key Disclosure

If there is sufficient interest I would like to present
draft-wing-sipping-srtp-key-02 at the upcoming SIPPING meeting in 
Vancouver.

Comments welcome.

-d

---

From: Dean Willis <[email-masked]>
Date: Fri, 23 Nov 2007 19:41:10 -0600

> draft-wing-sipping-srtp-key-02 at the upcoming SIPPING meeting in  

I concur, but would like to focus the discussion clearly on the  
requirements. Yes, you have a proposed solution, and looking at that  
solution is a good way to understand both the stated and unstated  
requirements you had in mind. Hopefully, that has now given you a  
very good understanding of the requirements.

This is good, because I expect the working group to stumble on the  
solution verbiage unless we have been taken through the requirements  
very carefully.

--
dean

---

From: Adam Roach <[email-masked]>
Date: Thu, 29 Nov 2007 15:12:27 -0600

On 11/23/07 7:41 PM, Dean Willis wrote:
> requirements.

I agree with Dean.

I have some relatively minor concerns about the way the current document 
uses RFCs 3903 and 3265, but will withhold them until we have a better 
grasp of the problem (there's no use doing a lot of protocol work on a 
solution that may change radically once we understand the real 
requirements).

/a