Subject: Re: [MMUSIC] Bundling data channel and RTP?

From: Christian Groves <[email-masked]>
Date: Thu, 21 May 2015 10:21:46 +1000

Can anyone confirm the intention that a single DTLS connection is used 
for SRTP key exchange and also SCTP packets?

draft-ietf-rtcweb-transports-08 indicates:

/WebRTC implementations MUST support multiplexing of DTLS and RTP over//
//   the same port pair, as described in the DTLS_SRTP specification//
//   [RFC5764], section 5.1.2.  All application layer protocol payloads//
//   over this DTLS connection are SCTP packets./

To me this implies a single DTLS connection. However in RFC5764 clause 
4.1 it says:
/Once the "use_srtp" extension is negotiated, the RTP or RTCP//
//   application data is protected solely using SRTP. Application data is//
//   never sent in DTLS record-layer "application_data" packets.  Rather,//
//   complete RTP or RTCP packets are passed to the DTLS stack, which//
//   passes them to the SRTP stack, which protects them appropriately.//
/
In the second sentence "application data" is not qualified with "RTP or 
RTCP" so it could be taken that its not possible to use the DTLS 
connection for anything else. However I take it that as the rest of the 
paragraph talks about RTP or RTCP that these were meant when application 
data is mentioned?

Can only one add some clarity?

Regards, Christian

On 29/04/2015 10:08 PM, Christian Groves wrote:
> Hello
>
> According to draft-ietf-rtcweb-data-channel-13 and 
> draft-ietf-rtcweb-transports-08, multiplexing of DTLS and RTP over the 
> same port pair must be supported and application layer protocol 
> payloads over this DTLS connection are SCTP packets, i.e. RTP and 
> datachannel share the same address:port.
>
> I assume this needs to be specified in SDP by two m-lines bundled 
> together. E.g. one with "UDP/TLS/RTP/SAVPF" & one with "UDP/DTLS/SCTP" 
> . However I can't find in any of the related drafts where this is 
> stated. I would think the BUNDLE and JSEP drafts should mention 
> something about this. Is there a draft that I've missed where this is 
> stated?
>
> Regards, Christian
>
> _______________________________________________
> mmusic mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mmusic
>

---

From: Magnus Westerlund <[email-masked]>
Date: Thu, 21 May 2015 11:34:14 +0200

> Can only one add some clarity?

Yes, that is clearly the intention as I understand it in WebRTC.

Cheers

Magnus Westerlund

----------------------------------------------------------------------
Services, Media and Network features, Ericsson Research EAB/TXM
----------------------------------------------------------------------
Ericsson AB                 | Phone  +46 10 7148287
Färögatan 6                 | Mobile +46 73 0949079
SE-164 80 Stockholm, Sweden | mailto: [email-masked]
----------------------------------------------------------------------

---

From: Martin Thomson <[email-masked]>
Date: Thu, 21 May 2015 11:55:04 -0700

On 20 May 2015 at 17:21, Christian Groves <[email-masked]> wrote:
> Can anyone confirm the intention that a single DTLS connection is used for
> SRTP key exchange and also SCTP packets?

Yes, the record layer carries SCTP and exporters from the same session
are used to key SRTP.

---

From: Christian Groves <[email-masked]>
Date: Fri, 22 May 2015 17:20:04 +1000

Hello Magnus and Martin,

Thanks for confirming that.

It would be good to cover bundling the SRTP and DTLS/SCTP m-lines the BUNDLE and JSEP drafts.

Regards, Christian

---

From: Christer Holmberg <[email-masked]>
Date: Mon, 25 May 2015 01:59:20 +0000

Hi,

I wonder whether we should have a "DTLS considerations" section in BUNDLE, and specify that all bundled media MUST use the same DTLS connection for key management, encryption etc.

Would it even be possible to establish multiple DTLS connections on a single 5-tuple?

Regards,

Christer

-----Original Message-----
From: mmusic [mailto:[email-masked]] On Behalf Of Christian Groves
Sent: 22 May 2015 10:20
To: [email-masked]
Subject: Re: [MMUSIC] Bundling data channel and RTP?

Hello Magnus and Martin,

Regards, Christian

> for SRTP key exchange and also SCTP packets?

Yes, the record layer carries SCTP and exporters from the same session are used to key SRTP.

On 21/05/2015 7:34 PM, Magnus Westerlund wrote:
>> Can anyone confirm the intention that a single DTLS connection is 
>> used for SRTP key exchange and also SCTP packets?
>>
>> In the second sentence "application data" is not qualified with "RTP 
>> or RTCP" so it could be taken that its not possible to use the DTLS 
>> connection for anything else. However I take it that as the rest of 
>> the paragraph talks about RTP or RTCP that these were meant when 
>> application data is mentioned?
>>

---

From: Paul Kyzivat <[email-masked]>
Date: Mon, 25 May 2015 12:16:59 -0400

> I wonder whether we should have a "DTLS considerations" section in BUNDLE, and specify that all bundled media MUST use the same DTLS connection for key management, encryption etc.

Yes, that makes sense.

> Would it even be possible to establish multiple DTLS connections on a single 5-tuple?

I don't think so.

Note that RTP is "special" in this regard, in that it uses DTLS for the 
keying, but it doesn't use DTLS payload packets.

If there were more than one m-line that used DTLS payload packets then 
they would also have to specify how to multiplex among them. AFAIK there 
is currently no way to do that, so there can only be one m-line that 
uses DTLS payload packets.

	Thanks,
	Paul

---

From: Christer Holmberg <[email-masked]>
Date: Tue, 26 May 2015 00:50:01 +0000

Hi,

>> I wonder whether we should have a "DTLS considerations" section in 
>> BUNDLE, and specify that all bundled media MUST use the same DTLS 
>> connection for key management, encryption etc.
>
> Yes, that makes sense.
>
> Note that RTP is "special" in this regard, in that it uses DTLS for the keying, but 
> it doesn't use DTLS payload packets.
>
> If there were more than one m-line that used DTLS payload packets then they 
> would also have to specify how to multiplex among them. AFAIK there is currently 
> no way to do that, so there can only be one m-line that uses DTLS payload packets.

This is covered in section 9.

Section 9.2 contains the following statement:

	"[RFC5764] does not describe how to identify different protocols
   	transported on DTLS, only how to identify the DTLS protocol itself.
   	If multiple protocols are transported on DTLS, there MUST exist a
   	specification describing a mechanism for identifying each individual
   	protocol. In addition, if a received DTLS packet can be associated
   	with more than one "m=" line, there MUST exist a specification which
   	describes a mechanism for associating the received DTLS packet with
   	the correct "m=" line."

Regards,

Christer

>> ---------------------------------------------------------------------
>> - Services, Media and Network features, Ericsson Research EAB/TXM

---

From: Paul Kyzivat <[email-masked]>
Date: Tue, 26 May 2015 10:03:46 -0400

> This is covered in section 9.

OK. Sorry.

	Paul

>>> -