Subject: [straw] IETF#90: Draft STRAW minutes

From: Christer Holmberg <[email-masked]>
Date: Sat, 26 Jul 2014 14:23:31 +0000

(Co-chair)

Hi,

Below are the STRAW minutes that the chairs intend to upload.

However, before we do that, we would like to ask the community to take a look at least at the notes associated with the DTLS-SRTP presentation, as it caused lots of discussion.

Note that the minutes do not contain who-said-what information (that can be found elsewhere), but if you think there are some important things missing, or if you think something is wrong, please let the chairs now.

Thanks!

Regards,

Christer & Victor

-------------------

IETF 90 - STRAW

1150-1320 EDT    Friday Afternoon Session I

Topic:     Agenda bashing, IETF Note Well and WG status

Presenter: Christer Holmberg (co-chair)

Slides:       http://www.ietf.org/proceedings/90/slides/slides-90-straw-0.pdf

Draft:     N/A

No issues were identified.

Topic:     Guidelines to support RTCP in B2BUAs

Presenter: Lorenzo Miniero

Slides:       http://www.ietf.org/proceedings/90/slides/slides-90-straw-1.pdf

Draft:     draft-ietf-straw-b2bua-rtcp

It was indicated that XR needs to be looked into, to see whether something needs to be covered in the draft.

It was indicated that the terminology will be aligned with the grouping-taxonomy draft. In case there are conflicts, or other issues are found, the STRAW community is requested to provide comments on the grouping-taxonomy draft.

It was requested whether the draft should also cover RTP specific issues. It was indicated that the scope of the RTCP, and that we should be very careful about introducing RTP issues. It was recommended to talk to Colin Perkins whether he has any opinions regarding the need to cover RTP.

I was asked how the document will relate to the work on multisource optimisation taking place in AVTEXT.

It was indicated that the text recommending man in the middle functionality for SRTP most likely will cause issues with IESG. After the DTLS-SRTP discussion (see further down) it was suggested that the RTCP draft should not talk about SRTP.

Topic:     Taxonomy Discussion

Presenter: Lorenzo Miniero

Slides:       http://www.ietf.org/proceedings/90/slides/slides-90-straw-2.pdf

Draft:     All STRAW deliveries

It was agreed the STRAW shall use the terms in the avtext-grouping-taxonomy document in preference to definitions elsewhere is they are appropriate, with a note indicating any differences in other documents that may influence understanding.

Topic:     STUN handling in B2BUAs

Presenter: Lorenzo Miniero (on behalf of the draft authors)

Slides:       http://www.ietf.org/proceedings/90/slides/slides-90-straw-3.pdf

Draft:     draft-ram-straw-b2bua-stun

It was indicated that B2BUA, due to policy reasons, may strip candidates from SDP.

It was indicated that B2BUAs must be very careful to not perform actions that will cause ICE mismatch.

The chair informed the community that a WG adoption request will be sent out within the upcoming weeks.

It was indicated that the group needs to follow the ICE bis work taking place in MMUSIC, in case there will be any impacts on the STRAW draft.

Topic:     DTLS-SRTP handling in B2BUAs

Presenter: Lorenzo Miniero (on behalf of the draft authors)

Slides:       http://www.ietf.org/proceedings/90/slides/slides-90-straw-4.pdf

Draft:     draft-ram-straw-b2bua-dtls-srtp

The presentation triggered lots of discussions and controversy, as it was seen as an attempt to standardize MITM (man in the middle procedures). While people did realize such actions take place in deployments, they claimed that IETF/STRAW should not standardize such procedures. It was also indicated that it goes against a number of BCP specifications, and RFC 2804. Others indicated that the purpose is to make sure that entities doing this kind of functionality do it in a way which does not cause interoperability problems, which could cause people to not use security to begin with.

It was indicated that one possible way forward could be to simply document, in an informal delivery, how different vendors do things in the network, but in such case the vendors should also be listed in the document.

Before the draft is adopted as a WG item, further discussions need to take place. The ADs will help with finding the correct people (security, IESG, etc) to involve in such discussions. The chair indicated that the draft implements a charter delivery, but that one possible outcome will be to remove/re-scope the charter delivery.

---

From: "Parthasarathi R" <[email-masked]>
Date: Wed, 30 Jul 2014 07:04:05 +0530

Hi all,

I have different view than the security folks look at this draft. This draft
intention is not to violate RFC 2804. In case this draft is not
standardized, all B2BUA handling DTLS-SRTP will end up in violating RFC 2804
due to the lack of guidelines/standards to follow. Please look into this
draft from SIP recording architecture in B2BUA (Fig 1 of RFC 7245) usage
perspective wherein the senders/receiver is informed about the call
recording (like call centre usage scenario) and no RFC 2804 violation.

In IETF-90 meeting, the security concerns are raised about this draft usage.
It will be good to document as part of this document if it is really
security issue. I'm not seeing any major security concerns as B2BUA is yet
another UA. Please let me know the list of security concern specific to
B2BUA in DTLS-SRTP.

In reality, B2BUA terminating DTLS-SRTP is not avoidable because of the
different codec profile between the deployed SIP UAs. Say SIPoWS in browser
(WebRTC endpoint/SIP UA) uses Opus/G711/VP8 as a codec as of today and SIP
Mobile devices uses AMR/AMR-WB/H.264. There is a compulsion to terminate the
media in the middle as there is no solution exists in IETF for the same. The
lack of standard leads to proprietary session border controller (SBC)
solutions which breaks other SIP enhancements as well.

Thanks

Partha

From: straw [mailto:[email-masked]] On Behalf Of Christer Holmberg
Sent: Saturday, July 26, 2014 7:54 PM
To: [email-masked]
Cc: Richard Barnes ([email-masked]); Sean Turner; Stephen Farrell
Subject: [straw] IETF#90: Draft STRAW minutes

(Co-chair)

Hi,

However, before we do that, we would like to ask the community to take a
look at least at the notes associated with the DTLS-SRTP presentation, as it
caused lots of discussion.

Note that the minutes do not contain who-said-what information (that can be
found elsewhere), but if you think there are some important things missing,
or if you think something is wrong, please let the chairs now.

Thanks!

Regards,

Christer & Victor

-------------------

IETF 90 - STRAW

 

Slides:
http://www.ietf.org/proceedings/90/slides/slides-90-straw-0.pdf

Draft:     N/A

 

Slides:
http://www.ietf.org/proceedings/90/slides/slides-90-straw-1.pdf 

 

It was indicated that XR needs to be looked into, to see whether something
needs to be covered in the draft.

It was indicated that the terminology will be aligned with the
grouping-taxonomy draft. In case there are conflicts, or other issues are
found, the STRAW community is requested to provide comments on the
grouping-taxonomy draft.

It was requested whether the draft should also cover RTP specific issues. It
was indicated that the scope of the RTCP, and that we should be very careful
about introducing RTP issues. It was recommended to talk to Colin Perkins
whether he has any opinions regarding the need to cover RTP.

I was asked how the document will relate to the work on multisource
optimisation taking place in AVTEXT.

It was indicated that the text recommending man in the middle functionality
for SRTP most likely will cause issues with IESG. After the DTLS-SRTP
discussion (see further down) it was suggested that the RTCP draft should
not talk about SRTP.

Slides:
http://www.ietf.org/proceedings/90/slides/slides-90-straw-2.pdf 

 

It was agreed the STRAW shall use the terms in the avtext-grouping-taxonomy
document in preference to definitions elsewhere is they are appropriate,
with a note indicating any differences in other documents that may influence
understanding.

Slides:
http://www.ietf.org/proceedings/90/slides/slides-90-straw-3.pdf 

 

It was indicated that B2BUA, due to policy reasons, may strip candidates
from SDP.

It was indicated that B2BUAs must be very careful to not perform actions
that will cause ICE mismatch.

The chair informed the community that a WG adoption request will be sent out
within the upcoming weeks.

It was indicated that the group needs to follow the ICE bis work taking
place in MMUSIC, in case there will be any impacts on the STRAW draft.

Slides:
http://www.ietf.org/proceedings/90/slides/slides-90-straw-4.pdf 

 

The presentation triggered lots of discussions and controversy, as it was
seen as an attempt to standardize MITM (man in the middle procedures). While
people did realize such actions take place in deployments, they claimed that
IETF/STRAW should not standardize such procedures. It was also indicated
that it goes against a number of BCP specifications, and RFC 2804. Others
indicated that the purpose is to make sure that entities doing this kind of
functionality do it in a way which does not cause interoperability problems,
which could cause people to not use security to begin with.

It was indicated that one possible way forward could be to simply document,
in an informal delivery, how different vendors do things in the network, but
in such case the vendors should also be listed in the document.

Before the draft is adopted as a WG item, further discussions need to take
place. The ADs will help with finding the correct people (security, IESG,
etc) to involve in such discussions. The chair indicated that the draft
implements a charter delivery, but that one possible outcome will be to
remove/re-scope the charter delivery.

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 30 Jul 2014 10:34:37 +0100

on vacation, back in a week

terminating DTLS-SRTP is maybe fine but means being one of the
endpoints intended to be involved in the TLS session. Doing a
MITM on TLS is  not at all fine.

S.

---

From: Sergio Garcia Murillo <[email-masked]>
Date: Wed, 30 Jul 2014 11:50:17 +0200

The sole purpose of a B2BUA is to become and endpoint (well two 
endpoints in fact) between two other endpoints:

Back-to-Back User Agent: A back-to-back user agent (B2BUA) is a
          logical entity that receives a request and processes it as a
          user agent server (UAS).  In order to determine how the request
          should be answered, it acts as a user agent client (UAC) and
          generates requests.

Best regards
Sergio

On 30/07/2014 11:34, Stephen Farrell wrote:
> _______________________________________________
> straw mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/straw

---

From: Christer Holmberg <[email-masked]>
Date: Wed, 30 Jul 2014 16:58:06 +0000

Hi Partha,

I am glad you are triggering a discussion on this :)

However, I would ask you to change the subject. The purpose of my e-mail was simply to request whether people have any issues with the meeting minutes as such, e.g. whether they think something is missing, and/or whether the minutes don't reflect what was discussed during the meeting :)

Regards,

Christer

From: Parthasarathi R [mailto:[email-masked]]
Sent: 30 July 2014 04:34
To: Christer Holmberg; [email-masked]
Cc: 'Richard Barnes'; 'Sean Turner'; 'Stephen Farrell'
Subject: B2BUA handling in DTLS-SRTP [was RE: [straw] IETF#90: Draft STRAW minutes]

Hi all,

I have different view than the security folks look at this draft. This draft intention is not to violate RFC 2804. In case this draft is not standardized, all B2BUA handling DTLS-SRTP will end up in violating RFC 2804 due to the lack of guidelines/standards to follow. Please look into this draft from SIP recording architecture in B2BUA (Fig 1 of RFC 7245) usage perspective wherein the senders/receiver is informed about the call recording (like call centre usage scenario) and no RFC 2804 violation.

In IETF-90 meeting, the security concerns are raised about this draft usage. It will be good to document as part of this document if it is really security issue. I'm not seeing any major security concerns as B2BUA is yet another UA. Please let me know the list of security concern specific to B2BUA in DTLS-SRTP.

In reality, B2BUA terminating DTLS-SRTP is not avoidable because of the different codec profile between the deployed SIP UAs. Say SIPoWS in browser (WebRTC endpoint/SIP UA) uses Opus/G711/VP8 as a codec as of today and SIP Mobile devices uses AMR/AMR-WB/H.264. There is a compulsion to terminate the media in the middle as there is no solution exists in IETF for the same. The lack of standard leads to proprietary session border controller (SBC) solutions which breaks other SIP enhancements as well.

Thanks
Partha

From: straw [mailto:[email-masked]] On Behalf Of Christer Holmberg
Sent: Saturday, July 26, 2014 7:54 PM
To: [email-masked]<mailto:[email-masked]>
Cc: Richard Barnes ([email-masked]<mailto:[email-masked]>); Sean Turner; Stephen Farrell
Subject: [straw] IETF#90: Draft STRAW minutes

(Co-chair)

Hi,

Thanks!

Regards,

Christer & Victor

-------------------

IETF 90 - STRAW

Draft:     N/A

---

From: "Parthasarathi R" <[email-masked]>
Date: Thu, 31 Jul 2014 06:53:31 +0530

Hi Christer,

Sorry, I replied to discuss about adopting this draft as a WG item.

Let us keep this mail thread to see the open items which blocks the adoption
of this draft J

I'll reply separately in the original mail thread to inform some of the
missing notes.

Thanks

Partha

From: straw [mailto:[email-masked]] On Behalf Of Christer Holmberg
Sent: Wednesday, July 30, 2014 10:28 PM
To: Parthasarathi R; [email-masked]
Cc: 'Richard Barnes'; 'Sean Turner'; 'Stephen Farrell'
Subject: Re: [straw] B2BUA handling in DTLS-SRTP [was RE: IETF#90: Draft
STRAW minutes]

Hi Partha,

However, I would ask you to change the subject. The purpose of my e-mail was
simply to request whether people have any issues with the meeting minutes as
such, e.g. whether they think something is missing, and/or whether the
minutes don't reflect what was discussed during the meeting :)

Regards,

Christer

From: Parthasarathi R [mailto:[email-masked]] 
Sent: 30 July 2014 04:34
To: Christer Holmberg; [email-masked]
Cc: 'Richard Barnes'; 'Sean Turner'; 'Stephen Farrell'
Subject: B2BUA handling in DTLS-SRTP [was RE: [straw] IETF#90: Draft STRAW
minutes]

Hi all,

Thanks

Partha

(Co-chair)

Hi,

Thanks!

Regards,

Christer & Victor

-------------------

IETF 90 - STRAW

 

Slides:

Draft:     N/A

 

Slides:

 

 

Slides:

 

 

Slides:

 

 

Slides:

---

From: "Parthasarathi R" <[email-masked]>
Date: Thu, 31 Jul 2014 07:07:31 +0530

Hi Christer,

The following discussion is missing in the minutes:

1)      PSTN interworking - Here, there is no end-to-end DTLS-SRTP and
DTLS-SRTP is terminated in the network and not in the actual endpoint. 

Thanks

Partha

(Co-chair)

Hi,

Thanks!

Regards,

Christer & Victor

-------------------

IETF 90 - STRAW

 

Slides:

Draft:     N/A

 

Slides:

 

 

Slides:

 

 

Slides:

 

 

Slides:

---

From: "Parthasarathi R" <[email-masked]>
Date: Thu, 31 Jul 2014 07:14:22 +0530

I agree with Sergio. 

Also, Stephen proposal of terminating DTLS-SRTP is weak in security in case
of the B2BUA transcoding (one codec to another codec) usecase wherein one of
the UA and B2BUA *MUST* communicate using plain RTP.

Thanks
Partha

> -----Original Message-----
> From: straw [mailto:[email-masked]] On Behalf Of Sergio Garcia
> Murillo
> Sent: Wednesday, July 30, 2014 3:20 PM
> To: [email-masked]
> Subject: Re: [straw] B2BUA handling in DTLS-SRTP [was RE: IETF#90:
> Draft STRAW minutes]
>

---

From: Mary Barnes <[email-masked]>
Date: Thu, 31 Jul 2014 11:57:51 -0500

Hi Christer,

I have one point for clarification below wrt our lively discussion around
DTLS-SRTP.

Mary.

On Sat, Jul 26, 2014 at 9:23 AM, Christer Holmberg <
[email-masked]> wrote:

> look at least at the notes associated with the DTLS-SRTP presentation, as
> it caused lots of discussion.
>
>
>
> Note that the minutes do not contain who-said-what information (that can
> be found elsewhere), but if you think there are some important things
> missing, or if you think something is wrong, please let the chairs now.
>
>
>
> Thanks!
>
>
>
> Regards,
>
>
>
> Christer & Victor
>
>
>
> -------------------
>
>
>
> *IETF 90 - STRAW*
>
> *1150-1320 EDT    Friday Afternoon Session I*
>
>
>
>
>
> *Topic:     Agenda bashing, IETF Note Well and WG status*
>
> *Presenter: Christer Holmberg (co-chair)*
>
> *Slides:
> <http://www.ietf.org/proceedings/90/slides/slides-90-straw-0.pdf>*
>
> *Draft:     N/A*
>
>
>
>
>
> *Topic:     Guidelines to support RTCP in B2BUAs*
>
> *Presenter: Lorenzo Miniero*
>
> *Slides:
> <http://www.ietf.org/proceedings/90/slides/slides-90-straw-1.pdf> *
>
> *Draft:     draft-ietf-straw-b2bua-rtcp *
>
>
>
>
>
> It was requested whether the draft should also cover RTP specific issues.
> It was indicated that the scope of the RTCP, and that we should be very
> careful about introducing RTP issues. It was recommended to talk to Colin
> Perkins whether he has any opinions regarding the need to cover RTP.
>
>
>
> It was indicated that the text recommending man in the middle
> functionality for SRTP most likely will cause issues with IESG. After the
> DTLS-SRTP discussion (see further down) it was suggested that the RTCP
> draft should not talk about SRTP.
>
>
>
>
>
>
>
> *Topic:     Taxonomy Discussion*
>
> *Presenter: Lorenzo Miniero*
>
> *Slides:
> <http://www.ietf.org/proceedings/90/slides/slides-90-straw-2.pdf> *
>
> *Draft:     All STRAW deliveries *
>
>
>
>
>
> It was agreed the STRAW shall use the terms in the
> avtext-grouping-taxonomy document in preference to definitions elsewhere is
> they are appropriate, with a note indicating any differences in other
> documents that may influence understanding.
>
>
>
>
>
>
>
> *Topic:     STUN handling in B2BUAs*
>
> *Presenter: Lorenzo Miniero (on behalf of the draft authors)*
>
> *Slides:
> <http://www.ietf.org/proceedings/90/slides/slides-90-straw-3.pdf> *
>
> *Draft:     draft-ram-straw-b2bua-stun *
>
>
>
>
>
> *Topic:     DTLS-SRTP handling in B2BUAs*
>
> *Presenter: Lorenzo Miniero (on behalf of the draft authors)*
>
> *Slides:
> <http://www.ietf.org/proceedings/90/slides/slides-90-straw-4.pdf> *
>
> *Draft:     draft-ram-straw-b2bua-dtls-srtp *
>
>
>
>
>
> seen as an attempt to standardize MITM (man in the middle procedures).
> While people did realize such actions take place in deployments, they
> claimed that IETF/STRAW should not standardize such procedures. It was also
> indicated that it goes against a number of BCP specifications, and RFC
> 2804. Others indicated that the purpose is to make sure that entities doing
> this kind of functionality do it in a way which does not cause
> interoperability problems, which could cause people to not use security to
> begin with.
>
>
>
> It was indicated that one possible way forward could be to simply
> document, in an informal delivery, how different vendors do things in the
> network, but in such case the vendors should also be listed in the document.
>
[MB] I'm recalling discussion of several options here:
1)  Publish as an informational WG deliverable with appropriate
caveats/warnings/disclaimers (the doc is currently Standards track)
2)  Publish as AD sponsored/information with appropriate
caveats/warnings/disclaimers
3)  Publish via the Independent Series Editor.  This is where the idea of
identifying specific vendors came up. This has been done a number of times
for a variety of vendors for a variety of unpopular topics.  [The
responsible AD likely will vehemently oppose this idea, but it is a totally
valid and practical route for things of this nature. ]
[/MB]