Subject: Re: [AVT] Updates to draft-ietf-avt-ulp

From: Colin Perkins <[email-masked]>
Date: Wed, 1 Mar 2006 07:56:17 +0000

Adam,

On 1 Mar 2006, at 04:53, Adam Li wrote:
> Restricting that FEC has to be before or after encryption is too  
> limiting, I
> think, especially because the encryption can be in a lot of  
> different ways
> other than SRTP. That section is concerning about the security  
> consideration
> in general and thus it may be necessary to talk about the issues  
> one might
> need to consider if encryptions are done in all different  
> configurations.

If I remember correctly, all the other RTP payload formats make such  
a restriction. If there are current use cases for both orderings,  
then fine, otherwise I would suggest defining one method only.

Colin

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt

---

From: Magnus Westerlund <[email-masked]>
Date: Wed, 01 Mar 2006 09:39:28 +0100

Hi,

The reason I see for keeping both is the following.

Most commmon use case, the one having the security context performs the 
FEC. In this case there are no issues with performing FEC first and then 
encrypting before transmission.

The case I think will be less commonly used. But which still is pretty 
useful case is when the media stream is first protected by the media 
transmitter. Then one realize that FEC is needed, and added by a node 
not trusteed with the security context. In that case the FEC will be 
performed on the encrypted packets.

It would have been good to have only one case. However I have heard of 
actually cases when this second use case is in use.

Cheers

Magnus

Colin Perkins wrote:
>> think, especially because the encryption can be in a lot of different 
>> ways
>> in general and thus it may be necessary to talk about the issues one 
>> might
>> need to consider if encryptions are done in all different configurations.
> 
> If I remember correctly, all the other RTP payload formats make such a 
> restriction. If there are current use cases for both orderings, then 
> fine, otherwise I would suggest defining one method only.
> 
> Colin
> 

-- 

Magnus Westerlund

Multimedia Technologies, Ericsson Research EAB/TVA/A
----------------------------------------------------------------------
Ericsson AB                | Phone +46 8 4048287
Torshamsgatan 23           | Fax   +46 8 7575550
S-164 80 Stockholm, Sweden | mailto: [email-masked]

---

From: Colin Perkins <[email-masked]>
Date: Wed, 1 Mar 2006 10:09:09 +0000

Hi,

On 1 Mar 2006, at 08:39, Magnus Westerlund wrote:
> Most commmon use case, the one having the security context performs  
> the FEC. In this case there are no issues with performing FEC first  
> and then encrypting before transmission.
>
> The case I think will be less commonly used. But which still is  
> pretty useful case is when the media stream is first protected by  
> the media transmitter. Then one realize that FEC is needed, and  
> added by a node not trusteed with the security context. In that  
> case the FEC will be performed on the encrypted packets.
>
> It would have been good to have only one case. However I have heard  
> of actually cases when this second use case is in use.

Okay. But can this discussion go into the security considerations  
section of the draft?

Colin