Subject: Re: [siprec] Keying of recording session

From: Leon Portman <[email-masked]>
Date: Thu, 30 Sep 2010 15:21:00 +0200

I completely agree. Not for all SRC and not for all media types it will be feasible. Actually the main concern was about security implications of using the same keys twice. Like for example if one of the parties wants to record only part of the encrypted conversation and does not want to share original keys with recording system. So using separate keys will solve this

Leon

----- Original Message -----
From: Cullen Jennings <[email-masked]>
To: Elwell, John <[email-masked]>
Cc: Leon Portman; [email-masked] <[email-masked]>
Sent: Thu Sep 30 15:16:36 2010
Subject: Re: [siprec] Keying of recording session

So I think Leon's point is there are cases where you need the keys to be different and I agree with him on that. But there also cases where they are huge advantages to having the keys be the same. I think the solution should support both. I imagine different will likely be the default but the folks that are recording telepresence conference call are simply not going to use different keys - if they solution mandates different keys, they will not use this solution. They have too much traffic to easily decrypt and re-encrypt it all. 

I would suggest updating the requirements to say the solution MUST support different keys, and MAY/SHOULD/or/MUST support shared keys. I don't care about if it is MAY/SHOULD/orMUST because I have no idea what they words mean in requirement document to start with. 

On Sep 30, 2010, at 3:05 AM, Elwell, John wrote:

> Personally I am not sure I understand the answers Leon gives, but I will wait for Cullen's reaction. Anyway, I have opened ticket #44 on this question. Please continue discussions on that new thread.
> 
> John
> 
> > -----Original Message-----
> > From: [email-masked]
> > [mailto:[email-masked]] On Behalf Of Leon Portman
> > Sent: 28 September 2010 14:50
> > To: Cullen Jennings; [email-masked]
> > Subject: Re: [siprec] Keying of recording session
> >
> > Two main reasons:
> > 1. We don't want escrow original conversation (CS) keys to SRS
> > 2. Current interpretation of PCI compliance (Payment Card
> > Industry) is that you need to have separate keys for separate
> > conversations (for example 128 bit for CS and 256 for RS,
> > because it is a choke point)
> >
> > Leon
> >
> > -----Original Message-----
> > From: [email-masked]
> > [mailto:[email-masked]] On Behalf Of Cullen Jennings
> > Sent: Tuesday, September 28, 2010 3:17 PM
> > To: [email-masked]
> > Subject: [siprec] Keying of recording session
> >
> >
> > Why does the recording session need to use different keys?
> > _______________________________________________
> > siprec mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/siprec
> > _______________________________________________
> > siprec mailing list
> > [email-masked]
> > https://www.ietf.org/mailman/listinfo/siprec
> >
>