Subject: [Ecrit] draft-ietf-ecrit-phonebcp-05.txt: Media

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Tue, 14 Oct 2008 14:49:25 +0300

Looking at Section 14 about media I was wondering whether the usage of
SRTP wouldn't make sense.
For key management I would go for SDES. 

What do you think? 

_______________________________________________
Ecrit mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ecrit

---

From: "Brian Rosen" <[email-masked]>
Date: Tue, 14 Oct 2008 08:53:13 -0400

There are so many things in phonebcp that are not implemented, adding SRTP,
and then insisting on SDES is really dooming interoperability.  I do think,
generally, that encrypting the media is a good thing, but I can't even see
"SHOULD".

Brian

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Tschofenig, Hannes (NSN - FI/Espoo)
Sent: Tuesday, October 14, 2008 7:49 AM
To: ECRIT
Subject: [Ecrit] draft-ietf-ecrit-phonebcp-05.txt: Media

What do you think?

---

From: Henning Schulzrinne <[email-masked]>
Date: Tue, 14 Oct 2008 11:38:09 -0400

SIPConnect has versions, so maybe we should either punt on these for  
now or we could make some of these aspirational. In other words, if  
you are spec'ing a new system, you should ask your vendor about this,  
but it may be on the product roadmap rather than something we expect  
today. This still tells the industry where we want to go, without  
raising the bar unreasonably for today's products.

Henning

---

From: "Gunnar Hellstrom" <[email-masked]>
Date: Tue, 14 Oct 2008 18:12:34 +0200

Interoperability with emergency services is a powerful harmonizing factor. 
There is an apparent need to harmonize media security.

By the reference to RFC 4504 in section 9, we already have a vague
recommendation to implement SRTP, so I suggest to continue on that track and
have a SHOULD for SRTP in ecrit-phonebcp and a MUST in ecrit-framework. I am
less in phase with how the current key management discussion is, but
recommend to make a decision even there for a SHOULD for one specific
mechanism. It is much more important to decide on one harmonised
recommendation than to discuss which mecanism is the perfect one.

This is what RFC 4504 says: 
---------------------------------------------
4.3.  Privacy

   Media Encryption
         Secure RTP (SRTP) [62] MAY be used for the encryption of media
         such as audio, text, and video, after the keying information
         has been passed by SIP signaling.  Instant messaging MAY be
         protected end-to-end using S/MIME.
----------------------------------------------

/ Gunnar  
-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Brian Rosen
Sent: Tuesday, October 14, 2008 2:53 PM
To: 'Tschofenig, Hannes (NSN - FI/Espoo)'; 'ECRIT'
Subject: Re: [Ecrit] draft-ietf-ecrit-phonebcp-05.txt: Media

Brian

-----Original Message-----

Looking at Section 14 about media I was wondering whether the usage of SRTP
wouldn't make sense.
For key management I would go for SDES. 

What do you think? 

__________ NOD32 3520 (20081014) Information __________

Detta meddelande dr genomsvkt av NOD32 Antivirus.
http://www.nod32.com

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Tue, 14 Oct 2008 21:06:40 +0300

I see your concerns. 

>From: [email-masked] [mailto:[email-masked]] 
>On Behalf Of Brian Rosen
>Sent: 14 October, 2008 15:53
>There are so many things in phonebcp that are not implemented, 
>adding SRTP, and then insisting on SDES is really dooming 
>interoperability.  I do think, generally, that encrypting the 
>media is a good thing, but I can't even see "SHOULD".
>
>Brian
>
>From: [email-masked] [mailto:[email-masked]] 
>On Behalf Of Tschofenig, Hannes (NSN - FI/Espoo)
>Looking at Section 14 about media I was wondering whether the 
>usage of SRTP wouldn't make sense.