Subject: RE: [Sipping] :draft-jain-sipping-srtp-00.txt

From: Kavita Jain <[email-masked]>
Date: Tue, 2 Sep 2003 10:32:08 -0400

Dear Mr. Arkko and Jennings,

Thanks for providing your feedback on the draft. The issue of DH key
security should be ok as the SDP will carry only the public part of the DH
key. Certainly securing and encrypting the SDP would make things more
secured, but then the idea behind this new approach is to have a
light-weight and less CPU-intensive process. To begin with, it is SRTP
versus IPSec. :) 

Thanks

kavita  

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Jari Arkko <[email-masked]>
Date: Wed, 10 Sep 2003 13:26:16 +0300

> light-weight and less CPU-intensive process. To begin with, it is SRTP

We have now read your draft better, including
some of the references, and it seems that we
understand better now what you are aiming.
Indeed, it is possible to get authentication
via the use of statically published D-H public
keys. So the initially worry of mitms is not
an issue. However, using static DH keys has
drawbacks associated with it, which MAY defeat
(part of) the purpose of DH, more below

We've been trying to compare this approach to
the one in draft-ietf-msec-mikey-07.txt.
Here are the differences that we found.

* The proposed scheme corrspondends closest to
   the D-H alternative in MIKEY. The computational
   effort appears roughly the same. The differences
   are:
   - MIKEY has PFS, the proposed scheme does not.
     In fact, the DH mode in MIKEY was questioned
     but it was decided to be kept, largely due to its
     PFS properties (when not using static keys).

* The proposed scheme does not appear to make
   it possible to negotiate algorithms, choose
   authentication methods, etc.

   Experience with SRTP standardization is that
   a single static config does not suffice for all IP
   multimedia scenarios, in particular "on/off" of
   integrity is essential to control.

   The proposed approach does not talk about
   how to turn integrity protection on in SRTP.
   This seems necessary, no?

* The two other modes in MIKEY (shared secret
   and RSA authentication) appear less computationally
   intensive than any scheme involving D-H.

Also, we were wondering why you talk about 64 bit
D-H keys. This does not appear to bring a very
strong security, or did we miss something?
Firstly, 64 bit DH keys has an effective security
of about 32 bits. Secondly, even if you mean that the DES
key is 64 bits, this is too small for todays recommended
security levels. Also, what mode would you run DES in?
Some modes are better suited for e.g. wireless than others.

-- Jari, Mats, and Fredrik