Subject: [straw] Review of draft-ietf-straw-b2bua-dtls-srtp-00

From: Simon Perreault <[email-masked]>
Date: Tue, 12 May 2015 16:46:03 -0400

Here's my overview of draft-ietf-straw-b2bua-dtls-srtp-00. This is
coming from the point of view of someone having implementation
experience with both SRTP and DTLS-SRTP.

Overall, the draft does not offer much practical, usable advice. I don't
really see what questions this draft is answering. Now, I know the topic
pretty well, so maybe I'm not in the target audience. But still, does
anyone find this draft useful? It seems to me there's not much meat on
the bone...

Section "1.1.  Overview" contains:

>    DTLS-SRTP is defined for point-to-point
>    media sessions, in which there are exactly two participants.  Each
>    DTLS-SRTP session contains a single DTLS association, and either two
>    SRTP contexts (if media traffic is flowing in both directions on the
>    same host/port quartet) or one SRTP context (if media traffic is only
>    flowing in one direction).

- Do you have a reference for the term "DTLS-SRTP session"?

- "host/port quartet" is more commonly called "5-tuple".

- This overview seems to disregard the effects of SIP forking. It might
be worth pointing out that a single SIP INVITE may generate N DTLS
associations after forking.

Simon

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Fri, 15 May 2015 08:19:53 +0000

> -----Original Message-----
> From: straw [mailto:[email-masked]] On Behalf Of Simon Perreault
> Sent: Wednesday, May 13, 2015 2:16 AM
> To: [email-masked]; [email-masked]
> Subject: [straw] Review of draft-ietf-straw-b2bua-dtls-srtp-00
> 
> Here's my overview of draft-ietf-straw-b2bua-dtls-srtp-00. This is coming
> from the point of view of someone having implementation experience with
> both SRTP and DTLS-SRTP.
> 
> Overall, the draft does not offer much practical, usable advice. I don't really
> see what questions this draft is answering. Now, I know the topic pretty well,
> so maybe I'm not in the target audience. But still, does anyone find this draft
> useful? It seems to me there's not much meat on the bone...

The draft was previously discussing B2BUA in media-termination which requires SRTP and DTLS-SRTP to be discussed in detail, but that mode was removed from the draft based on the consensus that B2BUA breaks privacy. The draft now gives guidance for B2BUA to follow so that good B2BUA actors don't manipulate certificate fingerprint in the SDP and break the DTLS session; It also discusses if there are bad B2BUA actors breaking into the DTLS session then identity validation procedure can be used to detect MIM attacks.
 
> - Do you have a reference for the term "DTLS-SRTP session"?

Yes, it is mentioned in https://tools.ietf.org/html/rfc5764

> - "host/port quartet" is more commonly called "5-tuple".

Yup, will change in the next revision. 

> 
> - This overview seems to disregard the effects of SIP forking. It might be
> worth pointing out that a single SIP INVITE may generate N DTLS associations
> after forking.

Yes, will add SIP forking.

Cheers,
-Tiru

> 
> Simon
> 
> _______________________________________________
> straw mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/straw