Subject: Re: [AVTCORE] Second WGLC on draft-ietf-avtcore-srtp-encrypted-header-ext

From: Ron Even <[email-masked]>
Date: Mon, 10 Sep 2012 18:32:54 +0300

Hi,
Plesae review the document
Roni

On Mon, Aug 27, 2012 at 8:38 PM, Roni Even <[email-masked]> wrote:

> Hi,****
>
> I would like to start a second WGLC on
> http://tools.ietf.org/html/draft-ietf-avtcore-srtp-encrypted-header-ext-02.
> ****
>
> The draft finished a WGLC and there were comments from the WG chairs.
> These comments were addressed but since we did not have enough reviewers we
> are asking for more reviews****
>
> ** **
>
> Please review the documents and send any comments by September 15th****
>
> ** **
>
> Thanks****
>
> Roni Even****
>
> AVTCore co-chair****
>

---

From: Colin Perkins <[email-masked]>
Date: Tue, 11 Sep 2012 22:39:07 +0100

Roni,

I read the -02 version of the draft. The proposal looks reasonable to me.

Colin

On 10 Sep 2012, at 16:32, Ron Even wrote:
> I would like to start a second WGLC on http://tools.ietf.org/html/draft-ietf-avtcore-srtp-encrypted-header-ext-02 .
> 
> The draft finished a WGLC and there were comments from the WG chairs. These comments were addressed but since we did not have enough reviewers we are asking for more reviews
> 
>  
> 
> Please review the documents and send any comments by September 15th
> 
>  
> 
> Thanks
> 
> Roni Even
> 
> AVTCore co-chair
> 
> 
> _______________________________________________
> Audio/Video Transport Core Maintenance
> [email-masked]
> https://www.ietf.org/mailman/listinfo/avt

-- 
Colin Perkins
http://csperkins.org/

---

From: Magnus Westerlund <[email-masked]>
Date: Wed, 12 Sep 2012 09:27:26 +0200

As Individual,

I have review this version and think it is suitable for publication.

Mvh

Magnus

On 2012-08-27 19:38, Roni Even wrote:
> http://tools.ietf.org/html/draft-ietf-avtcore-srtp-encrypted-header-ext-02 .
> 
> These comments were addressed but since we did not have enough reviewers
> we are asking for more reviews
> 
>  
> 
> Please review the documents and send any comments by September 15^th
> 
>  
> 
> Thanks
> 
> Roni Even
> 
> AVTCore co-chair
> 

-- 

Magnus Westerlund

----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVM
----------------------------------------------------------------------
Ericsson AB                | Phone  +46 10 7148287
Färögatan 6                | Mobile +46 73 0949079
SE-164 80 Stockholm, Sweden| mailto: [email-masked]
----------------------------------------------------------------------

---

From: "David McGrew (mcgrew)" <[email-masked]>
Date: Wed, 12 Sep 2012 12:08:08 +0000

Hi Roni,

I've read the new version.   I think this is a good idea, and the draft is well written.   I have only a few specific suggestions.   Most importantly, it is not clear (to me, anyway) how the mask is generated.   It will be essential for interoperability that all of the participants in the session use identical values for the mask, but the draft doesn't describe how a receiver would know the mask value that the sender has selected.  I had expected that the mask value would be sent as a part of "urn:ietf:params:rtp-hdrext:encrypt", or something like that.  I think this point needs to be clarified in the draft.

The header encryption operation is described in a way that would change the CTR (or f8) encryption operation ("The SRTP participant bitwise-ANDs the encryption mask with the keystream to produce a masked keystream").   However, what I hope/expect that implementations will do is implement header encryption in a way that does not change any of the crypto functions.    The header encryption can be described in terms of manipulations of the plaintext and ciphertext, like this:

    EncryptedHeader = (Encrypt(Key, Plaintext)  AND MASK)  OR (Plaintext AND (NOT MASK))

Many implementations would prefer this approach, because it enables them to use their encryption functions in a way that is unchanged.   For instance, the crypto function might be implemented in a separate software library, or provided by a hardware function; the encryption function might be part of a validated crypto module, and thus there would be strong motivation not to alter it (and undo the validation).    The current text in the draft is clear, so I don't recommend changing it.   But I suggest providing an alternative description of the algorithm in a separate paragraph that follows the current description.

The security of the mask-based mechanism is sound, when used with the existing SRTP crypto transforms, as described in Section 3.   However, if the mechanism is applied to other encryption methods, like ECB or CBC, then it would not be a sound approach.   The alternative way of describing the encryption scheme in terms of plaintext manipulations might make it look like the scheme could be applied to ECB or CBC.   So I suggest putting a statement in the security considerations saying "This technique can only be applied to encryption transforms that work by generating a pseudorandom keystream and bitwise exclusive-oring it with the plaintext, such as CTR or f8; it MUST NOT be used with ECB, CBC, or any other encryption method that does not use a keystream, or a loss of security will entail."

David

From: Ron Even <[email-masked]<mailto:[email-masked]>>
Date: Monday, September 10, 2012 11:32 AM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [AVTCORE] Second WGLC on draft-ietf-avtcore-srtp-encrypted-header-ext

Hi,

On Mon, Aug 27, 2012 at 8:38 PM, Roni Even <[email-masked]<mailto:[email-masked]>> wrote:
Hi,
I would like to start a second WGLC on http://tools.ietf.org/html/draft-ietf-avtcore-srtp-encrypted-header-ext-02 .
The draft finished a WGLC and there were comments from the WG chairs. These comments were addressed but since we did not have enough reviewers we are asking for more reviews

Thanks
Roni Even
AVTCore co-chair

---

From: "Brandenburg, R. (Ray) van" <[email-masked]>
Date: Thu, 13 Sep 2012 07:04:49 +0000

Hi Roni,

I have reviewed this document and think it is ready for publication.

Ray

From: [email-masked] [mailto:[email-masked]] On Behalf Of Ron Even
Sent: maandag 10 september 2012 17:33
To: [email-masked]
Subject: Re: [AVTCORE] Second WGLC on draft-ietf-avtcore-srtp-encrypted-header-ext

Hi,

Thanks
Roni Even
AVTCore co-chair

This e-mail and its contents are subject to the DISCLAIMER at http://www.tno.nl/emaildisclaimer

---

From: Qin Wu <[email-masked]>
Date: Fri, 14 Sep 2012 13:38:23 +0800

I have no comments and think it is ready for publication.

Regards!
-Qin
  ----- Original Message ----- 
  From: Ron Even 
  To: [email-masked] 
  Sent: Monday, September 10, 2012 11:32 PM
  Subject: Re: [AVTCORE] Second WGLC ondraft-ietf-avtcore-srtp-encrypted-header-ext

  Hi,

    Hi,

    Thanks

    Roni Even

    AVTCore co-chair

------------------------------------------------------------------------------

---

From: Jonathan Lennox <[email-masked]>
Date: Fri, 14 Sep 2012 12:37:57 -0400

Hi, David -- thanks for your comments!

On Sep 12, 2012, at 8:08 AM, David McGrew (mcgrew) wrote:

Since the header extension elements' header bytes are sent in the clear, the mask can be calculated for each packet.  You know from the SDP which header extension IDs correspond to encrypted elements.  When you parse a header extension, you see the ID and length for each header extension element, and calculate the mask accordingly.

The mask can differ on a packet-by-packet basis, since different header extension elements (either encrypted or plaintext) can be sent in different packets.

I can clarify this in the text, if you think it would be helpful.

That's a good idea.  I think an earlier version of the draft may have presented it in the alternate way you suggest; but I agree, giving both descriptions, and making it clear that they're equivalent, would probably be helpful.

I agree, good idea.

Thanks!

--
Jonathan Lennox
[email-masked]<mailto:[email-masked]>

---

From: "David McGrew (mcgrew)" <[email-masked]>
Date: Fri, 14 Sep 2012 17:01:43 +0000

Hi Jonathan,

From: Jonathan Lennox <[email-masked]<mailto:[email-masked]>>
Date: Friday, September 14, 2012 12:37 PM
To: Cisco Employee <[email-masked]<mailto:[email-masked]>>
Cc: Ron Even <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [AVTCORE] Second WGLC on draft-ietf-avtcore-srtp-encrypted-header-ext

That makes sense.   I went back for a second look at the draft, and I realized that this was my stumbling block: I did not keep in mind the fact that "The encryption mask corresponds to the entire payload of each header extension element that is encrypted."   I was (incorrectly) thinking that a mask might cover only part of a payload for a particular header extension.

That might be useful (though I am the only person that got confused on this point :-)

I agree, good idea.

Sounds good.   Let's make this an RFC.

David

Thanks!