Subject: draft-ietf-avt-rtp-mpeg4-03

From: "M. Reha Civanlar" <[email-masked]>
Date: Thu, 13 Jul 2000 14:45:51 -0400

I am enclosing an updated version (03) of the ID entitled:

RTP Payload Format for MPEG-4 Streams - draft-ietf-avt-rtp-mpeg4-03

This document describes a payload format for transporting MPEG-4
encoded data using RTP.

Thanks.

----------------------------------------------------------------------------
----------
M. Reha Civanlar
Division Manager, AT&T Labs - Research
100 Schultz Drive, 3-215, Red Bank, NJ 07701, U.S.A
Ph: +1 732 345 3305
Fax: +1 732 345 3033
[email-masked]
http://www.research.att.com/info/mrc

---

From: Leonid Rosenboim <[email-masked]>
Date: Sun, 16 Jul 2000 08:22:30 +0200

I have a couple of comments:

1. The following goal is stated in the ID:
    i. Ability to synchronize MPEG-4 streams with other RTP payloads
Could someone explain which other multimedia streams could be appropriate and
are not supported as part of the MPEG-4 framework ? In toehr words, my
impression is that MPEG-4 defines everything one could imagine, even a
replacement to HTML for navigating content, so what else is there to synchronize
with other then MPEG-4 ?

2. Regarding security:

It has been quite a while since the security paragraph of the RTP specification
has been written, and neother RTP nor this draft are addressing the security
issues which are now central to every Internet service. In toehr words,
following security issues should be addressed:

 A. How does this RTP profile handle pakcet filters and firewalls traversed by
this payload traffic?
 B. What are (if any) the volnurabilities to Denial Of Service attacks exposed
by implementing this payload format for a client or server ?

One could reasonably argue that these issues do not belong in a payload
specification, but rather in the RTP spec itself, but the is no work that I am
aware of for revising the RTP spec, so how shall we address these issues?

Hope this helps,
Leonid Rosenboim
Chief Technical Officer
BitBand Technologies Ltd.

"M. Reha Civanlar" wrote:

>   ------------------------------------------------------------------------
>                                       Name: draft-ietf-avt-rtp-mpeg4-03.txt
>    draft-ietf-avt-rtp-mpeg4-03.txt    Type: Plain Text (text/plain)
>                                   Encoding: quoted-printable

---

From: Colin Perkins <[email-masked]>
Date: Mon, 17 Jul 2000 10:25:40 -0400

[4-on-IP list cc'd for comments...]

>replacement to HTML for navigating content, so what else is there to synchronize

The installed base of H.323 terminals, SIP terminals, RealAudio, etc., none
of which support MPEG-4.

>by implementing this payload format for a client or server ?

Indeed, the current security considerations section is lacking for this
payload format, given the broad range of content MPEG-4 may transport (the
second paragraph in particular is not accurate). At the least, we should
discuss the different types of content which may be transported in MPEG-4
and their risks (e.g. streaming java code in MPEG-4 via MPEG-J). 

The points you raise are also important - I wonder if the correct place to
handle them is in the RTP payload format, or in the MPEG specification (or,
more likely, both)?  Does MPEG discuss the security implications of it's 
framework?

I note that draft-ietf-avt-mpeg4streams-00.txt has similar deficiencies in
its security considerations section. And someone more familiar with MPEG-4
should view draft-ietf-avt-rtp-mpeg4-es-02.txt and check that it is okay.

>aware of for revising the RTP spec, so how shall we address these issues?

The RTP specification is in the process of being revised, see
  http://www.ietf.org/internet-drafts/draft-ietf-avt-rtp-new-07.txt
  http://www.ietf.org/internet-drafts/draft-ietf-avt-profile-new-08.txt
(I believe there is a new revision of these due for this meeting). We would
welcome additions to the security considerations section of this, or of any
payload format.

Cheers,
Colin