Subject: Re: [dispatch] Fwd: I-D Action: draft-johnston-dispatch-osrtp-00.txt

From: "Roni Even" <[email-masked]>
Date: Wed, 4 Nov 2015 06:05:56 +0200

Hi,

In my view this approach contradict section 6.11 of RFC5763

Best Effort Encryption

   [RFC5479] describes a requirement for best-effort encryption where

   SRTP is used and where both endpoints support it and key negotiation

   succeeds, otherwise RTP is used.

   [MMUSIC-SDP] describes a mechanism that can signal both RTP and SRTP

   as an alternative.  This allows an offerer to express a preference

   for SRTP, but RTP is the default and will be understood by endpoints

   that do not understand SRTP or this key exchange mechanism.

   Implementations of this document MUST support [MMUSIC-SDP <https://tools.ietf.org/html/rfc5763#ref-MMUSIC-SDP> ].

From: dispatch [mailto:[email-masked]] On Behalf Of Alan Johnston
Sent: Wednesday, July 08, 2015 2:03 PM
To: [email-masked]
Subject: [dispatch] Fwd: I-D Action: draft-johnston-dispatch-osrtp-00.txt

All,

Many of us have been talking about "Best Effort SRTP" for many years, and there are a number of deployments.  In addition, the IMTC has recommended it, and the SIP Forum would like to recommend it in SIPconnect 2.0 which for the first time includes SRTP media.  With the publication of RFC 7435 (https://tools.ietf.org/html/rfc7435), the IETF has endorsed this approach as Opportunistic Security (OS), so it would be nice to bring standards in line with industry practice.

Comments on the draft, "An Opportunistic Approach for Secure Real-time Transport Protocol (OSRTP)" and the best way forward are most welcome!

- Alan -

---------- Forwarded message ----------
From: <[email-masked]>
Date: Mon, Jul 6, 2015 at 1:48 PM
Subject: I-D Action: draft-johnston-dispatch-osrtp-00.txt
To: [email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts directories.

        Title           : An Opportunistic Approach for Secure Real-time Transport Protocol (OSRTP)
        Authors         : Alan Johnston
                          Bernard Aboba
                          Andy Hutton
                          Laura Liess
                          Thomas Stach
        Filename        : draft-johnston-dispatch-osrtp-00.txt
        Pages           : 8
        Date            : 2015-07-06

Abstract:
   Opportunistic Secure Real-time Transport Protocol (OSRTP) allows
   encrypted media to be used in environments where support for
   encryption is not known in advance, and not required.  OSRTP is an
   implementation of Opportunistic Security, as defined in RFC 7435.
   OSRTP does not require advanced SDP extensions or features and is
   fully backwards compatible with existing secure and insecure
   implementations.  OSRTP is not specific to any key management
   technique for SRTP.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-johnston-dispatch-osrtp/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-johnston-dispatch-osrtp-00

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i-d-announce <https://www.ietf.org/mailman/listinfo/i-d-announce%0d%0aInternet-Draft> 
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: Laura Liess <[email-masked]>
Date: Wed, 4 Nov 2015 11:52:41 +0100

Hi Roni,

[MMUSIC-SDP <https://tools.ietf.org/html/rfc5763#ref-MMUSIC-SDP>] is now
RFC 5939 and it seems to be a MUST for implementations of the  RFC 5763
(SRTP with DTLS).

At Deutsche Telekom we plan to connect SIP-PBXe in the near future using
SRTP with SDES.  We are not aware of any existing SIP-PBX which supports
RFC 5763, most existing SIP-PBXs suport different flavors of the
kaplan-draft. RFC 5763 seems to be too complex so that PBX vendors are not
willing to support it, at least in connection with SDES. This is also the
case for our service provider call control vendors.  So, a less complex
mechanism is needed for best effort SRTP.

Thank you
Laura

2015-11-04 5:05 GMT+01:00 Roni Even <[email-masked]>:

> *Best Effort Encryption*
>    Implementations of this document MUST support [MMUSIC-SDP
> <https://tools.ietf.org/html/rfc5763#ref-MMUSIC-SDP>].
>
>
>
>
>
> *From:* dispatch [mailto:[email-masked]] *On Behalf Of *Alan
> Johnston
> *Sent:* Wednesday, July 08, 2015 2:03 PM
> *To:* [email-masked]
> *Subject:* [dispatch] Fwd: I-D Action:
> draft-johnston-dispatch-osrtp-00.txt
>
>
>
> All,
>
>
>
> Many of us have been talking about "Best Effort SRTP" for many years, and
> there are a number of deployments.  In addition, the IMTC has recommended
> it, and the SIP Forum would like to recommend it in SIPconnect 2.0 which
> for the first time includes SRTP media.  With the publication of RFC 7435 (
> https://tools.ietf.org/html/rfc7435), the IETF has endorsed this approach
> as Opportunistic Security (OS), so it would be nice to bring standards in
> line with industry practice.
>
>
>
> Comments on the draft, "An Opportunistic Approach for Secure Real-time
> Transport Protocol (OSRTP)" and the best way forward are most welcome!
>
>
>
> - Alan -
>
>
>
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft
> <https://www.ietf.org/mailman/listinfo/i-d-announce%0d%0aInternet-Draft>
> directories: http://www.ietf.org/shadow.html
> dispatch mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dispatch
>
>

---

From: "Hutton, Andrew" <[email-masked]>
Date: Wed, 4 Nov 2015 13:30:57 +0000

Agree with Laura what we are doing here is aligning existing implementations that already exist in the field and document that in and RFC so that we can move forward with regard to deployment of SRTP in SIP Trunking environments.

Currently RFC 5763 is not supported at all in this environment and I have not heard a single voice in support of using SDP capability negotiation for SIP Trunking.

Moving forward with the draft is our best chance of seeing SRTP start to be deployed with SIP Trunking.

Andy

On 4 Nov 2015, at 19:52, Laura Liess <[email-masked]<mailto:[email-masked]>> wrote:

Hi Roni,

[MMUSIC-SDP<https://tools.ietf.org/html/rfc5763#ref-MMUSIC-SDP>] is now RFC 5939 and it seems to be a MUST for implementations of the  RFC 5763 (SRTP with DTLS).

At Deutsche Telekom we plan to connect SIP-PBXe in the near future using SRTP with SDES.  We are not aware of any existing SIP-PBX which supports RFC 5763, most existing SIP-PBXs suport different flavors of the kaplan-draft. RFC 5763 seems to be too complex so that PBX vendors are not willing to support it, at least in connection with SDES. This is also the case for our service provider call control vendors.  So, a less complex mechanism is needed for best effort SRTP.

Thank you
Laura

2015-11-04 5:05 GMT+01:00 Roni Even <[email-masked]<mailto:[email-masked]>>:
Hi,
In my view this approach contradict section 6.11 of RFC5763

Best Effort Encryption

   Implementations of this document MUST support [MMUSIC-SDP<https://tools.ietf.org/html/rfc5763#ref-MMUSIC-SDP>].

From: dispatch [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Alan Johnston
Sent: Wednesday, July 08, 2015 2:03 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [dispatch] Fwd: I-D Action: draft-johnston-dispatch-osrtp-00.txt

All,

- Alan -

---------- Forwarded message ----------
From: <[email-masked]<mailto:[email-masked]>>
Date: Mon, Jul 6, 2015 at 1:48 PM
Subject: I-D Action: draft-johnston-dispatch-osrtp-00.txt
To: [email-masked]<mailto:[email-masked]>

Abstract:

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org<http://tools.ietf.org>.

_______________________________________________
I-D-Announce mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft<https://www.ietf.org/mailman/listinfo/i-d-announce%0d%0aInternet-Draft> directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

_______________________________________________
dispatch mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/dispatch

_______________________________________________
dispatch mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/dispatch

---

From: "Roni Even" <[email-masked]>
Date: Wed, 4 Nov 2015 23:52:04 +0200

HI,

My concern is about having inconsistency in the standards. If you go ahead
with OSRTP there is a need also to update RFC5763 accordingly

Roni

From: Hutton, Andrew [mailto:[email-masked]] 
Sent: Wednesday, November 04, 2015 3:31 PM
To: Laura Liess
Cc: Roni Even; [email-masked]
Subject: Re: [dispatch] Fwd: I-D Action:
draft-johnston-dispatch-osrtp-00.txt

Agree with Laura what we are doing here is aligning existing implementations
that already exist in the field and document that in and RFC so that we can
move forward with regard to deployment of SRTP in SIP Trunking environments.

Currently RFC 5763 is not supported at all in this environment and I have
not heard a single voice in support of using SDP capability negotiation for
SIP Trunking.

Moving forward with the draft is our best chance of seeing SRTP start to be
deployed with SIP Trunking.

Andy

 

On 4 Nov 2015, at 19:52, Laura Liess <[email-masked]> wrote:

Hi Roni,

[MMUSIC-SDP <https://tools.ietf.org/html/rfc5763#ref-MMUSIC-SDP> ] is now
RFC 5939 and it seems to be a MUST for implementations of the  RFC 5763
(SRTP with DTLS). 

At Deutsche Telekom we plan to connect SIP-PBXe in the near future using
SRTP with SDES.  We are not aware of any existing SIP-PBX which supports RFC
5763, most existing SIP-PBXs suport different flavors of the kaplan-draft.
RFC 5763 seems to be too complex so that PBX vendors are not willing to
support it, at least in connection with SDES. This is also the case for our
service provider call control vendors.  So, a less complex mechanism is
needed for best effort SRTP. 

Thank you

Laura 

Hi,

Best Effort Encryption

   Implementations of this document MUST support [MMUSIC-SDP
<https://tools.ietf.org/html/rfc5763#ref-MMUSIC-SDP> ].

All,

Many of us have been talking about "Best Effort SRTP" for many years, and
there are a number of deployments.  In addition, the IMTC has recommended
it, and the SIP Forum would like to recommend it in SIPconnect 2.0 which for
the first time includes SRTP media.  With the publication of RFC 7435
(https://tools.ietf.org/html/rfc7435), the IETF has endorsed this approach
as Opportunistic Security (OS), so it would be nice to bring standards in
line with industry practice.

- Alan -

---------- Forwarded message ----------
From: <[email-masked]>
Date: Mon, Jul 6, 2015 at 1:48 PM
Subject: I-D Action: draft-johnston-dispatch-osrtp-00.txt
To: [email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts
directories.

        Title           : An Opportunistic Approach for Secure Real-time
Transport Protocol (OSRTP)
        Authors         : Alan Johnston
                          Bernard Aboba
                          Andy Hutton
                          Laura Liess
                          Thomas Stach
        Filename        : draft-johnston-dispatch-osrtp-00.txt
        Pages           : 8
        Date            : 2015-07-06

Abstract: