Subject: [Sip] A proposal for breaking the DTLS-SRTP vs RFC4474 gateway deadlock

From: Dean Willis <[email-masked]>
Date: Tue, 24 Jun 2008 12:21:41 -0500

We've gotten stuck on a fine point in DTLS-SRTP.

The current draft-ietf-sip-dtls-srtp-framework-01 uses an RFC 4474  
Identity header to preserve the integrity of the media key's  
fingerprint, thereby detecting a certain class of MITM attack.

However, RFC 4474 Identity headers are of questionable validity when  
used with protocol gateways or B2BUAs.  More or less, they're capable  
of asserting the identity of the gateway, not the identity of the  
calling party. But the recipient has no real way to figure out which  
is which.

We've debated at some length, and with no good result, about whether  
we should try and fix RFC 4474. We've had some suggestions that may  
work for B2BUAs, and some other suggestions that may work for  
gateways, but we certainly don't have a consensus.

That leaves our chartered deliverable of DTLS-SRTP hanging, and the  
milestone has gone past months ago.

Here's a proposal:

We add a caveat about the limitation of RFC 4474 to draft-ietf-sip- 
dtls-srtp-framework and go ahead and advance that specification. If  
somebody later decides to fix RFC 4474, they can do so, and if  
necessary update DTLS-SRTP if needed.

Does that work for everybody?

If we agree to it, I suggest that we move the date for WGLC of draft- 
ietf-sip-dtls-srtp-framework to July 2008, and move the milestone for  
delivery of that doc to the IESG into September.

--
Dean
_______________________________________________
Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Eric Rescorla <[email-masked]>
Date: Tue, 24 Jun 2008 12:48:20 -0700

Dean,

This sounds like an excellent way to proceed. I'll generate some candidate text
and send it to the list in the next few days.

-Ekr

On Tue, Jun 24, 2008 at 10:21 AM, Dean Willis <[email-masked]> wrote:
> The current draft-ietf-sip-dtls-srtp-framework-01 uses an RFC 4474 Identity
> header to preserve the integrity of the media key's fingerprint, thereby
> detecting a certain class of MITM attack.
>
> However, RFC 4474 Identity headers are of questionable validity when used
> with protocol gateways or B2BUAs.  More or less, they're capable of
> asserting the identity of the gateway, not the identity of the calling
> party. But the recipient has no real way to figure out which is which.
>
> We've debated at some length, and with no good result, about whether we
> should try and fix RFC 4474. We've had some suggestions that may work for
> B2BUAs, and some other suggestions that may work for gateways, but we
> certainly don't have a consensus.
>
> We add a caveat about the limitation of RFC 4474 to
> draft-ietf-sip-dtls-srtp-framework and go ahead and advance that
> specification. If somebody later decides to fix RFC 4474, they can do so,
> and if necessary update DTLS-SRTP if needed.
>
>
> If we agree to it, I suggest that we move the date for WGLC of
> draft-ietf-sip-dtls-srtp-framework to July 2008, and move the milestone for

---

From: "Dan Wing" <[email-masked]>
Date: Tue, 24 Jun 2008 15:51:21 -0700

Works for me.  Thanks,
-d

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Dean Willis
> Sent: Tuesday, June 24, 2008 10:22 AM
> To: [email-masked]; Eric Rescorla; Jason Fischl
> Cc: Cullen Jennings; Keith Drage
> Subject: [Sip] A proposal for breaking the DTLS-SRTP vs 
> RFC4474 gatewaydeadlock
> 
>

---

From: "Fischer, Kai" <[email-masked]>
Date: Wed, 25 Jun 2008 10:05:59 +0200

If it is the goal to proceed with the DTLS-SRTP framework timely and to
reach the milestone, that's the only reasonable approach. However, I
hope there will be support to fix RFC 4474 and we can address the
backwards compatibility issues.

Kai

> Sent: Dienstag, 24. Juni 2008 19:22

---

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Wed, 25 Jun 2008 11:08:48 +0300

Dean, 

I like your approach. 

Ciao
Hannes

>Behalf Of ext Fischer, Kai
>Sent: 25 June, 2008 11:06
>To: Dean Willis; [email-masked]; Eric Rescorla; Jason Fischl
>Subject: Re: [Sip] A proposal for breaking the DTLS-SRTP vs 
>RFC4474gatewaydeadlock
>
>If it is the goal to proceed with the DTLS-SRTP framework 
>timely and to reach the milestone, that's the only reasonable 
>approach. However, I hope there will be support to fix RFC 
>4474 and we can address the backwards compatibility issues.
>
>Kai
>
>
>Behalf Of 
>> Dean Willis
>> This list is for NEW development of the core SIP Protocol Use 
>> [email-masked] for questions on current sip Use 
>> [email-masked] for new developments on the application of sip
>> 
>This list is for NEW development of the core SIP Protocol Use 
>[email-masked] for questions on current sip

---

From: "Elwell, John" <[email-masked]>
Date: Wed, 25 Jun 2008 09:34:42 +0100

Dean,

Yes, that would work for me, given an intent to push ahead with trying
to fix the RFC 4474 issues, e.g., through your proposed RETIRE WG.

John

> Sent: 24 June 2008 18:22
> RFC4474 gateway deadlock