Subject: [MMUSIC] BUNDLE: Meaning of "transported on DTLS"?

From: Christer Holmberg <[email-masked]>
Date: Thu, 6 Nov 2014 11:20:34 +0000

Hi,

I BUNDLE, we have the following text:

"If multiple protocols are transported on DTLS, there MUST exist a
                specification describing a mechanism for identify each individual
                protocol."

I think we need to clarify what we mean by "transported on DTLS". Are we talking about on a single DTLS connection, a single DTLS session, or something else?

Regards,

Christer

---

From: "Schwarz, Albrecht (Albrecht)" <[email-masked]>
Date: Thu, 6 Nov 2014 14:59:31 +0000

This is a good point!

> Are we talking about on a single DTLS connection, a single DTLS session, or something else?

Actually I'm also interested to get a clear semantic of DTLS connection vs DTLS session (and  even vs DTLS association, a term which indicated in the DTLS RFC too).
This is particularily of interest for
a) security reasons (due to the DTLS handshake protocol and DTLS change cipher spec protocol, which are running on session or connection level?, affecting session or connection information?)
b) to clarify text sth like "shares the DTLS connection with the SRTP media channels ..." in draft-ietf-rtcweb-data-channel: DTLS-SRTP actually does not allow to share the DTLS ? with other applications ("hence, there might be possible a single DTLS session and two DTLS connections, hm?) and
c) WebRTC gateways due to interworking scenarios.

Thanks for help from the (D)TLS experts community!
Albrecht

From: mmusic [mailto:[email-masked]] On Behalf Of Christer Holmberg
Sent: Donnerstag, 6. November 2014 12:21
To: [email-masked]
Subject: [MMUSIC] BUNDLE: Meaning of "transported on DTLS"?

Hi,

Regards,

Christer

---

From: Iñaki Baz Castillo <[email-masked]>
Date: Thu, 6 Nov 2014 16:15:36 +0100

2014-11-06 12:20 GMT+01:00 Christer Holmberg <[email-masked]>:
> I think we need to clarify what we mean by “transported on DTLS”. Are we
> talking about on a single DTLS connection, a single DTLS session, or
> something else?

I understand that "transported on DTLS" refers to SRTP (when the keys
exchanged is performed via a DTLS handsake) and DataChannel (which
obviously is a protocol on top of an established DTLS connection.

-- 
Iñaki Baz Castillo
<[email-masked]>

---

From: Christer Holmberg <[email-masked]>
Date: Thu, 6 Nov 2014 19:31:38 +0000

Hi Albrecht,

I think the RFCs explain the difference between DTLS session and DTLS connection - that is not what I was asking about.

I am more wondering about the text we have in BUNDLE :)

Regards,

Christer

From: Schwarz, Albrecht (Albrecht) [mailto:[email-masked]]
Sent: 06 November 2014 17:00
To: Christer Holmberg; [email-masked]
Cc: Arturo Martin De Nicolas
Subject: RE: BUNDLE: Meaning of "transported on DTLS"?

This is a good point!

From: mmusic [mailto:[email-masked]] On Behalf Of Christer Holmberg
Sent: Donnerstag, 6. November 2014 12:21
To: [email-masked]<mailto:[email-masked]>
Subject: [MMUSIC] BUNDLE: Meaning of "transported on DTLS"?

Hi,

Regards,

Christer

---

From: Justin Uberti <[email-masked]>
Date: Thu, 6 Nov 2014 11:44:13 -0800

I think it is clear we are talking about these protocols being multiplexed
across a single DTLS connection here.

On Thu, Nov 6, 2014 at 11:31 AM, Christer Holmberg <
[email-masked]> wrote:

>  Hi Albrecht,
>
>
>
> I think the RFCs explain the difference between DTLS session and DTLS
> connection – that is not what I was asking about.
>
>
>
> *From:* Schwarz, Albrecht (Albrecht) [mailto:
> [email-masked]]
> *Sent:* 06 November 2014 17:00
> *To:* Christer Holmberg; [email-masked]
> *Cc:* Arturo Martin De Nicolas
> *Subject:* RE: BUNDLE: Meaning of "transported on DTLS"?
>
>
>
> This is a good point!
>
>
>
> Actually I’m also interested to get a clear semantic of DTLS connection vs
> DTLS session (and  even vs DTLS association, a term which indicated in the
> DTLS RFC too).
>
> a) security reasons (due to the DTLS handshake protocol and DTLS change
> cipher spec protocol, which are running on session or connection level?,
> affecting session or connection information?)
>
> b) to clarify text sth like “shares the DTLS connection with the SRTP
> media channels …” in draft-ietf-rtcweb-data-channel: DTLS-SRTP actually
> does not allow to share the DTLS ? with other applications (“hence, there
> might be possible a single DTLS session and two DTLS connections, hm?) and
>
> *From:* mmusic [mailto:[email-masked] <[email-masked]>] *On
> Behalf Of *Christer Holmberg
> *Sent:* Donnerstag, 6. November 2014 12:21
> *To:* [email-masked]
> *Subject:* [MMUSIC] BUNDLE: Meaning of "transported on DTLS"?
>
>
>
> Hi,
>
>
>
> “If multiple protocols are transported on DTLS, there MUST exist a
>
>                 protocol.”
> _______________________________________________
> mmusic mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mmusic
>
>

---

From: Iñaki Baz Castillo <[email-masked]>
Date: Thu, 6 Nov 2014 23:33:31 +0100

> across a single DTLS connection here.

IMHO that's clear too. May be it should also be clear that SRTP is not
carried on top of a DTLS connection, but on top of a "channel"
established via a DTLS handshake.

-- 
Iñaki Baz Castillo
<[email-masked]>

---

From: Justin Uberti <[email-masked]>
Date: Thu, 6 Nov 2014 14:41:44 -0800

SRTP is already mentioned in the preceding paragraph (
https://tools.ietf.org/html/draft-ietf-mmusic-sdp-bundle-negotiation-12#section-9.2),
but I suppose you could spell it out here that the SRTP traffic is outside
the DTLS connection.

---

From: Paul Kyzivat <[email-masked]>
Date: Thu, 06 Nov 2014 17:49:29 -0500

> established via a DTLS handshake.

IIUC (dubious), SRTP is carried directly on UDP, multiplexed with DTLS 
messages. SRTP uses certain DTLS messages to negotiate the keys, so 
perhaps the key-negotiation part of SRTP can be considered to be within 
some aspect of DTLS. That might not be part of the DTLS *connection* - I 
would think that is reserved for the DTLS payload packets.

Clearly the layering here is very weird.

	Thanks,
	Paul

---

From: Christer Holmberg <[email-masked]>
Date: Fri, 7 Nov 2014 03:02:10 +0000

Hi,

AFAIK, you use a DTLS connection (I believe DTLS-SRTP uses another word, though) also for SRTP.

However, the text already describes how to separate SRTP packets from DTLS packets, so the piece of text I brought up only applies to DTLS packets.

Regards,

Christer

Sent from my Windows Phone
________________________________
From: Paul Kyzivat<mailto:[email-masked]>
Sent: ‎07/‎11/‎2014 00:49
To: [email-masked]<mailto:[email-masked]>
Subject: Re: [MMUSIC] BUNDLE: Meaning of "transported on DTLS"?

        Thanks,
        Paul

---

From: Justin Uberti <[email-masked]>
Date: Thu, 6 Nov 2014 23:17:06 -0800

No, the SRTP packets are sent outside the DTLS connection.

On Thu, Nov 6, 2014 at 7:02 PM, Christer Holmberg <
[email-masked]> wrote:

> However, the text already describes how to separate SRTP packets from DTLS
> packets, so the piece of text I brought up only applies to DTLS packets.
>
> Regards,
>
> Christer
>
>  ------------------------------
> From: Paul Kyzivat <[email-masked]>

---

From: Christer Holmberg <[email-masked]>
Date: Fri, 7 Nov 2014 10:16:21 +0000

Hi,

>No, the SRTP packets are sent outside the DTLS connection.

That is true, but don’t you create a DTLS connection just by negotiating the keys that you are going to use for SRTP?

(I do agree that “connection” is misleading.)

Regards,

Christer

On Thu, Nov 6, 2014 at 7:02 PM, Christer Holmberg <[email-masked]<mailto:[email-masked]>> wrote:
Hi,

Regards,

Christer

On 11/6/14 5:33 PM, Iñaki Baz Castillo wrote:
> 2014-11-06 20:44 GMT+01:00 Justin Uberti <[email-masked]<mailto:[email-masked]>>:

        Thanks,
        Paul

_______________________________________________
mmusic mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/mmusic

_______________________________________________
mmusic mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/mmusic

---

From: Christer Holmberg <[email-masked]>
Date: Fri, 7 Nov 2014 15:03:47 +0000

Hi,

DTLS-SRTP talks about “association”, but it’s the same thing as “connection”.

Section 3 in RFC 5764 says:

“Each DTLS-SRTP session contains a single DTLS association (called a "connection" in TLS jargon),…”

(EKR can probably explain why they chose to use different terminology)

Regards,

Christer

From: mmusic [mailto:[email-masked]] On Behalf Of Christer Holmberg
Sent: 07 November 2014 12:16
To: Justin Uberti
Cc: [email-masked]; Paul Kyzivat
Subject: Re: [MMUSIC] BUNDLE: Meaning of "transported on DTLS"?

Hi,

Regards,

Christer

Regards,

Christer

        Thanks,
        Paul

---

From: Justin Uberti <[email-masked]>
Date: Fri, 7 Nov 2014 14:32:03 -0800

In this context, the key exchange mechanism is immaterial. The key point is
that you don't need to demultiplex SRTP packets from other stuff arriving
on the DTLS connection, because those packets aren't sent on the DTLS
connection (and therefore the demux is already covered by 5764).

On Fri, Nov 7, 2014 at 2:16 AM, Christer Holmberg <
[email-masked]> wrote:

> That is true, but don’t you create a DTLS connection just by negotiating
> the keys that you are going to use for SRTP?
>
>
>
> *From: *Paul Kyzivat <[email-masked]>
> *Sent: *‎07/‎11/‎2014 00:49
> *To: [email-masked]
> *Subject: *Re: [MMUSIC] BUNDLE: Meaning of "transported on DTLS"?
>

---

From: Christer Holmberg <[email-masked]>
Date: Sat, 8 Nov 2014 09:46:08 +0000

Hi,

>In this context, the key exchange mechanism is immaterial. The key >point is that you don't need to demultiplex SRTP packets from other >stuff arriving on the DTLS connection, because those packets aren't >sent on the DTLS connection (and therefore the demux is already >covered by 5764).

Correct, and it’s also mentioned in BUNDLE.

So, again, the statement I referred to only covers packets which are DTLS encrypted.

Do we e.g. assume that all DTLS encrypted traffic will be transported on a single DTLS connection?

Regards,

Christer

On Fri, Nov 7, 2014 at 2:16 AM, Christer Holmberg <[email-masked]<mailto:[email-masked]>> wrote:
Hi,

Regards,

Christer

Regards,

Christer

        Thanks,
        Paul

---

From: "Schwarz, Albrecht (Albrecht)" <[email-masked]>
Date: Mon, 10 Nov 2014 16:10:49 +0000

Hi

>I think the RFCs explain the difference between DTLS session and DTLS connection – that is not what I was asking about.

Well, if the RFCs would provide a term definition then there wouldn’t be any discussion.
The TLS RFC provides a glossary, which helps somehow at high level, but doesn’t provide definitions as required for protocol discussions here.
And the thread just confirms that the supposed concepts are not really clear.

Regards,
Albrecht

From: mmusic [mailto:[email-masked]] On Behalf Of Christer Holmberg
Sent: Samstag, 8. November 2014 10:46
To: Justin Uberti
Cc: [email-masked]; Paul Kyzivat
Subject: Re: [MMUSIC] BUNDLE: Meaning of "transported on DTLS"?

Hi,

Regards,

Christer

Regards,

Christer

Regards,

Christer

        Thanks,
        Paul