Subject: [straw] Coming soon: WGLC for draft-ietf-straw-b2bua-dtls-srtp

From: Christer Holmberg <[email-masked]>
Date: Thu, 11 Jun 2015 07:42:54 +0000

(As co-chair)

Hi,

We are planning to start WGLC for draft-ietf-straw-b2bua-dtls-srtp soon. We are asking for a couple of volunteers for doing a WGLC review of the draft.

Before we start the WGLC, however, I have a couple of comments (mostly editorial) on the -03 version that I'd like the authors to address.

Q1:

I would suggest to change the title name of section 3 to something like "Media Plane B2BUA handling of DTLS-SRTP".

Then, I would suggest a "3.1 General" section, where you say that this section describes the DTLS-SRTP handling by the different types of media plane B2BUAs defined in RFC 7092.

Q2:

In the Security Considerations sections, would it be good to make it explicitly clear that the document does not define procedures where an endpoint is terminating DTLS?

(You DO mention in for one media b2bua type in section 3.2.1, but I think it would be good to have general text)

If anyone has issues that he/she thinks need to be addressed before we start WGLC, please raise those issues on the list.

Regards,

Christer

---

From: "Ram Mohan R (rmohanr)" <[email-masked]>
Date: Fri, 12 Jun 2015 10:12:42 +0000

I have another question on the draft for which I want some feedback from
WG-

Currently under Media-aware B2BUA (section 3.2) we have a section that
talks about B2BUA that can manipulate headers (section 3.2.2) for
DTLS-SRTP draft. The current text we have is:

EXISTING:
3.2.2.  RTP and RTCP Header Modification

   In addition to inspecting the RTP and RTCP headers, the B2BUAs
   explained in section 3.2.2 [RFC7092], can also potentially modify
   them.  To modify media headers a B2BUA needs to act as a DTLS
   intermediary and terminate the DTLS connection so it can decrypt/re-
   encrypt RTP packets.  This breaks end-to-end security.  This security
   and privacy problem can be addressed by having separate keys for
   encrypting the RTP header and media payload as discussed in
   [I-D.jones-avtcore-private-media-reqts], in which case the B2BUA is
   not aware of the keys used to decrypt the media payload.

Given that the work on using separate keys for media payload headers and
media payload is still in very early stage, should we have it here or just
remove that ? I believe its good to remove.

So here a updated proposed text for section 3.2.2

PROPOSED:

3.2.2.  RTP and RTCP Header Modification

   In addition to inspecting the RTP and RTCP headers, the B2BUAs
   explained in section 3.2.2 [RFC7092], can also potentially modify
   them.  To modify media headers a B2BUA needs to act as a DTLS
   intermediary and terminate the DTLS connection so it can decrypt/re-
   encrypt RTP packets.  This breaks end-to-end security. Hence a B2BUA
MUST 
   NOT terminated DTLS connections. The behavior of B2BUA acting as
   a man-in-the-middle, and as such its behaviour is unspecified.

Regards,
Ram

From:  Christer Holmberg <[email-masked]>
Date:  Thursday, 11 June 2015 1:12 pm
To:  "[email-masked]" <[email-masked]>
Cc:  "[email-masked]"
<[email-masked]>
Subject:  [straw] Coming soon: WGLC for draft-ietf-straw-b2bua-dtls-srtp

(As co-chair)
 
Hi,
 
We are planning to start WGLC for draft-ietf-straw-b2bua-dtls-srtp soon.
We are asking for a couple of volunteers for doing a WGLC review of the
draft.

Before we start the WGLC, however, I have a couple of comments (mostly
editorial) on the -03 version that I¹d like the authors to address.

Q1:
 
I would suggest to change the title name of section 3 to something like
"Media Plane B2BUA handling of DTLS-SRTP".
 
Then, I would suggest a "3.1 General" section, where you say that this
section describes the DTLS-SRTP handling by the different types of media
plane B2BUAs defined in RFC 7092.

Q2:
 
In the Security Considerations sections, would it be good to make it
explicitly clear that the document does not define procedures where an
endpoint is terminating DTLS?
 
(You DO mention in for one media b2bua type in section 3.2.1, but I think
it would be good to have general text)

If anyone has issues that he/she thinks need to be addressed before we
start WGLC, please raise those issues on the list.

Regards,
 
Christer