Subject: Re: [clue] Questions for Roni - RE: New draft-ietf-clue-framework-23

From: "Duckworth, Mark" <[email-masked]>
Date: Mon, 2 Nov 2015 10:55:35 -0800

Thanks Roni.  I will make these minor updates to the framework document accordingly.
Mark

From: Roni Even [mailto:[email-masked]]
Sent: Saturday, October 31, 2015 1:40 AM
To: Duckworth, Mark
Cc: [email-masked]
Subject: RE: Questions for Roni - RE: [clue] New draft-ietf-clue-framework-23

Hi,
Inline
Roni

From: Alissa Cooper [mailto:[email-masked]]
Sent: Saturday, October 03, 2015 8:45 AM
To: Duckworth, Mark
Cc: [email-masked]
Subject: Re: [clue] New draft-ietf-clue-framework-23

Thanks for these updates. There are still a few points from my evaluation concerning Section 15 that are outstanding.

First, this text proposed by Roni did not make it into the draft:

As described in section 5, CLUE uses SIP/SDP to establish the
   session prior to exchanging any CLUE specific information. Thus
   the security mechanisms recommended for SIP [RFC3261], including
   user authentication and authorization, MUST be supported.

[Duckworth, Mark] Thanks for catching this, it was an oversight on my part.  It should be as you say, from Roni’s proposal. I will correct it.

Furthermore, if the position of the WG is that it isn’t even going to recommend the use of authentication, you at least need to explain why, under what conditions, and the threats associated with operating this way.

From my previous review:

"In
  addition, the media is based on RTP and thus existing RTP security
  mechanisms SHOULD be supported, and DTLS/SRTP MUST be supported.
  Media security is also discussed in [I-D.ietf-clue-signaling] and
  [I-D.ietf-clue-rtp-mapping]."

I think it's worth pointing out in this document that DTLS/SRTP is required to use for CLUE-controlled m-lines.

[Duckworth, Mark] Roni, can you please clarify what the group’s final decision was on this? I thought we decided in April that DTLS/SRTP is mandatory to support, but not mandatory to use.  See this email topic https://mailarchive.ietf.org/arch/msg/clue/AC6H1QwQqTzSfdgOI8ZNT87OZOA . I counted six responses, with all six in favor of mandatory to support but not mandatory to use. I propose this alteration to the sentence about DTLS/SRTP in the framework document:

In addition, the media is based on RTP and thus existing RTP security mechanisms SHOULD be supported, and DTLS/SRTP MUST be supported and SHOULD be used. If media is protected by other means, then DTLS/SRTP does not need to be used.

[Roni] Mandatory to support was the consensus. The text you suggest above clarifies.

Also, I just did a quick skim of draft-ietf-clue-rtp-mapping and didn't see anything in there about media security.

[Duckworth, Mark] Roni, should I remove this reference to the RTP mapping document?  Or do you expect that document really will discuss media security?

Roni: the new revision of RTP mapping https://tools.ietf.org/html/draft-ietf-clue-rtp-mapping-05#section-10 discuss the securitry

"Thus, it MUST be possible for the endpoints to establish
  a channel which is secure against both message recovery and
  message modification. Further details on this are provided in the
  CLUE data channel solution document."

There are no details about how the data channel is secured in draft-ietf-clue-datachannel (which should be cited here if it's going to be referenced). Nor are the details in draft-ietf-rtcweb-data-channel, but rather they are in draft-ietf-rtcweb-security-arch and draft-ietf-rtcweb-security, where they are described for rtcweb which uses a different authentication model from clue. So how to do this actually needs to be explained either here or in the clue data channel document for clue specifically.
[Duckworth, Mark] I think the data channel document is the right place to describe how the data channel is secured. I will add a proper reference to it in the framework.
Thanks,
Alissa

On Sep 24, 2015, at 3:04 PM, Duckworth, Mark <[email-masked]<mailto:[email-masked]>> wrote:

Changes from 22 to 23:
1.            Updates to Security Considerations section.
2.            Update version number of references to other CLUE documents in progress.
3.            Change some "MAY" to "may".
4.            Fix a few grammatical errors.

Mark
_______________________________________________
clue mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/clue

---

From: "Roni Even" <[email-masked]>
Date: Tue, 3 Nov 2015 00:39:24 +0200

Hi Mark,

For other means add reference to RFC7201

Roni

From: Duckworth, Mark [mailto:[email-masked]] 
Sent: Monday, November 02, 2015 8:56 PM
To: Roni Even
Cc: [email-masked]
Subject: RE: Questions for Roni - RE: [clue] New draft-ietf-clue-framework-23

Mark

Hi,

Inline

Roni

"In

 

Thanks,

Alissa

On Sep 24, 2015, at 3:04 PM, Duckworth, Mark <[email-masked]> wrote:

Changes from 22 to 23:

Mark

_______________________________________________
clue mailing list
 <mailto:[email-masked]> [email-masked]
 <https://www.ietf.org/mailman/listinfo/clue> https://www.ietf.org/mailman/listinfo/clue