Subject: [AVT] ICE-TCP issue: DTLS-SRTP over TCP?

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 09 Jul 2007 16:14:39 -0400

My apologies for cc'ing AVT. However this is a cross-WG issue that 
impacts ICE and its usage with DTLS-SRTP.

ICE-tcp:
http://www.ietf.org/internet-drafts/draft-ietf-mmusic-ice-tcp-04.txt
DTLS-srtp:
http://www.ietf.org/internet-drafts/draft-ietf-avt-dtls-srtp-00.txt

One of the really nice features of ICE-tcp is that you can offer, for an 
RTP-based media stream, either UDP or TCP candidates. The TCP ones are 
tried as a last resort, so that you get RTP over UDP when it works, and 
RTP over TCP when it doesn't. This choice is made dynamically based on 
the results of the connectivity checks.

So, the interesting question is, what happens if the media is secure? 
Well, clearly if UDP is selected, we end up with DTLS-SRTP. In that 
case, the SDP offer would contain the fingerprint and setup attributes. 
What happens if ICE selects TCP instead? There are two things this could 
mean:

1. the media is secured using RTP over a TCP/TLS connection using 
RFC4571. This is *not* SRTP; the RTP packets are fully encrypted.

2. the media is secured using DTLS-SRTP, run over the RFC4571 shim that 
is ontop of TCP when ICE is in use. In this case, the media packets are 
SRTP and the RTP headers are in the clear as normal.

In many ways, #2 is a far preferable solution. It means that the 
mechanism for securing the media, and the associated SDP parameters and 
their meaning, are independent of the transport protocol and apply for 
UDP or TCP. With #1, the agent needs to run different protocols (TLS vs. 
DTLS) for security, depending on the transport protocol selected. That 
also has interactions with SDP capability negotiation, and it gets 
really messy.

So, #2 is what is specified in ice-tcp. However, AFAIK, DTLS-SRTP is not 
defined over TCP. I don't think it needs to change any per se; but it 
does need to be recognized as a valid mode.

Similarly, even ignoring a mix of UDP and TCP candidates, if we are just 
offering TCP candidates, does the media get secured using #1 or #2? Do 
we allow both? Right now ICE-tcp is allowing both. However, I think its 
bad to have two ways of doing this. I'd rather settle on DTLS-SRTP over 
TCP as the one and only way of securing RTP over TCP.

Comments?
-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Cisco Fellow                                   Parsippany, NJ 07054-2711
Cisco Systems
[email-masked]                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt