Subject: RE: [AVT] RE: KM approach using MIKEY and EKT

From: "Fries, Steffen" <[email-masked]>
Date: Wed, 28 Jun 2006 10:37:37 +0200

> >> That assumes auth-via-SIP as opposed to media channel.  By 
> "ACKed by 
> >> the other side" I meant media-channel-ack, not SIP ACK.  In either 
> >> case, though, an optional (user-configured) separate timer makes 
> >> sense.
> >
> >[stf] I'm not sure if I understand the usecase here. I 
> thought as long 
> >as early media is sent the caller cannot send media back as 
> he does not 
> >have the right address information as long as the signaling 
> answer is 
> >missing.
> 
> Early media can be 2-way...  (really).
[stf] wow, I didn't know that. How does the signaling work in this
scenario, i.e., how does the caller know where to send his media. I
guess there must be a predefined port. What would be a use case for
that?

> Also, the attacker might modify a response to 
> eliminate/bid-down crypto.
[stf] okay, this emphasizes the requirement for end-to-end negotiation
and detection of MiTM attacks. 
> Or block media keying response but not signalling.
[stf] this may be suspicious for the caller, especially, when you
combine approaches from the signaling and the media path (as originally
discussed)

Ciao
	Steffen
> 
> --
> Randell Jesup, Worldgate (developers of the Ojo videophone), 
> ex-Amiga OS team [email-masked] "The fetters imposed on 
> liberty at home have ever been forged out of the weapons 
> provided for defence against real, pretended, or imaginary 
> dangers from abroad."
> 		- James Madison, 4th US president (1751-1836)
> 
> 

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt

---

From: Randell Jesup <[email-masked]>
Date: Thu, 29 Jun 2006 16:09:48 -0400

>guess there must be a predefined port. What would be a use case for

My understanding is that there are, such as for IVR systems to get a PIN
for a calling cart - Note that "early media" here means "before 200 OK",
not "before answer".  The answer is in a 18x response.  Since this is still
offer/answer, the fact that it's "early media" may not be relevant. 

See RFC's 3959 and 3960.

>combine approaches from the signaling and the media path (as originally

Right.  Part of the issue with bid-down and blocking of key exchange is how
to handle, including how to indicate this to a user unambiguously.  There
is probably no way to unify this, since it depends on the use of the
device, the user, and the threat profile.  We could give guidelines and
examples, however.

-- 
Randell Jesup, Worldgate (developers of the Ojo videophone), ex-Amiga OS team
[email-masked]