Subject: [Speermint] Secure RTP

From: "Khan, Sohel Q [CTO]" <[email-masked]>
Date: Tue, 1 Aug 2006 13:02:55 -0500

Should SPEERMINT require Secure RTP for VoIP peering?

(see section 3.4 ...  Editor's Note, SPEERMINT Requirements draft)

Thanks,

Sohel Khan

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint

---

From: "Patrick Melampy" <[email-masked]>
Date: Tue, 1 Aug 2006 14:26:11 -0400

Not in my opinion. Both Codecs and SRTP can be negotiated at the signaling
plane. Why bother requiring things that are already supported during the
offer answer process.

-----Original Message-----
From: Khan, Sohel Q [CTO] [mailto:[email-masked]] 
Sent: Tuesday, August 01, 2006 2:03 PM
To: [email-masked]
Subject: [Speermint] Secure RTP

Thanks,

Sohel Khan

---

From: Andrew Newton <[email-masked]>
Date: Tue, 01 Aug 2006 14:33:43 -0400

> (see section 3.4 ...  Editor's Note, SPEERMINT Requirements draft)

Considering all the talk about TLS, sure.

-andy

---

From: "Brian Rosen" <[email-masked]>
Date: Tue, 1 Aug 2006 14:54:04 -0400

I think we want to ask the question: Is the peering system transparent to
media?  This does not imply anything about media anchor points either end
might have, but asks do we assume that the peering system is transparent to
media or do we assume it is NOT transparent.

Let me give you two extremes:

One is a peering system that does not provide ANY media services.  It's just
a signaling interworking and peering system.  It doesn't care what is in the
SDP, doesn't have any affect on the SDP; it's completely transparent to the
media, which would flow from the origination to termination (ignoring
transit) outside of the peering system.

The other is a media switch.  All media goes to the switch which switches it
to the other side.  It acts as a B2BUA for all calls.

I think that we are looking at case 1, and not at case 2.  I don't think we
care about the media. 

So, from strictly a peering point of view, this is a don't care, but like
the codec choice, if you want interoperability, you have to state the
assumptions or you won't get it.  In this case I think it's strictly
optional (that is, all participants must be prepared to accept RTP that is
not protected with SRTP).

Brian

> From: Andrew Newton [mailto:[email-masked]]
> Sent: Tuesday, August 01, 2006 2:34 PM
> To: Khan, Sohel Q [CTO]
> Cc: [email-masked]
> Subject: Re: [Speermint] Secure RTP
>

---

From: Andrew Newton <[email-masked]>
Date: Tue, 01 Aug 2006 15:07:01 -0400

> I think that we are looking at case 1, and not at case 2.  I don't think we

Interesting.  I don't know about you, but I get paid for getting the media 
right.  Perfect signaling is useless without media.

-andy

---

From: "Stastny Richard" <[email-masked]>
Date: Tue, 1 Aug 2006 21:10:51 +0200

>I think that we are looking at case 1, and not at case 2.  I don't think we

Yes
 
First things first
 
a solution to case 1 is required for case 2 anyway

-sta

________________________________

Von: Brian Rosen [mailto:[email-masked]]
Gesendet: Di 01.08.2006 20:54
An: 'Andrew Newton'; 'Khan, Sohel Q [CTO]'
Cc: [email-masked]
Betreff: RE: [Speermint] Secure RTP

Brian

---

From: "Brian Rosen" <[email-masked]>
Date: Tue, 1 Aug 2006 15:32:46 -0400

Sure, but does the peering touch the media?  I claim it doesn't, at least
normally.  "Getting it right" means that when the signaling happens, the
resulting SDP will work.  That part (the SDP part) matters to us, because we
have to make sure that when that SDP gets to the other side, it will result
in something that works.  The peering system doesn't have to even look at
the SDP, it just has to have rules that make interoperability work.

The peering system has to, for example, make sure that an address given in
the SDP on one side is actually reachable on the other side.  Doing that
doesn't involve any work, it's just rules the federation agrees to that
makes that be true. So, we might need to specify no NAT or conversely, MUST
support ICE.  That all speaks to what the peers have to have between their
endpoints and their peers.  It doesn't imply the media packets traverse the
peering fabric.

Of course, in theory, the peering system doesn't even have to touch the
signaling, but we don't have to go there.

Brian

> Sent: Tuesday, August 01, 2006 3:07 PM
> To: Brian Rosen
> Cc: 'Khan, Sohel Q [CTO]'; [email-masked]

---

From: "Hadriel Kaplan" <[email-masked]>
Date: Tue, 1 Aug 2006 16:09:00 -0400

But there are currently 11(?) proposed SRTP key exchange mechanisms, some
using SDP, some not - none of which interoperate.  So "interoperability" is
impacted there, and part of it is a signaling issue.  In that sense it may
well be reasonable for a speermint BCP to pick one preferred mechanism, but
I'm sure that will be yet another rat-hole.  And I recommend we stay out of
those when we can.  :)
(besides, the RTPSEC-BOF group is assigned that Herculean task)

-hadriel

> From: Brian Rosen [mailto:[email-masked]]
> Sent: Tuesday, August 01, 2006 3:33 PM
> To: 'Andrew Newton'
> Subject: RE: [Speermint] Secure RTP
> 
> > > I think that we are looking at case 1, and not at case 2.  I don't
> think
> > we
> > > care about the media.
> >

---

From: "Henry Sinnreich" <[email-masked]>
Date: Tue, 1 Aug 2006 13:57:29 -0700

> Perfect signaling is useless without media.

Amen and please y'all remember it.

Thanks, Henry

-----Original Message-----
From: Andrew Newton [mailto:[email-masked]] 
Sent: Tuesday, August 01, 2006 12:07 PM
To: Brian Rosen
Cc: 'Khan, Sohel Q [CTO]'; [email-masked]
Subject: Re: [Speermint] Secure RTP

> I think that we are looking at case 1, and not at case 2.  I don't
think we
> care about the media. 

Interesting.  I don't know about you, but I get paid for getting the
media 
right.  Perfect signaling is useless without media.

-andy