Subject: [dispatch] Proposed SIPBRANDY Charter

From: "Ben Campbell" <[email-masked]>
Date: Tue, 17 May 2016 17:28:38 -0400

Hi,

DISPATCH participants will recall the discussion about improvements to 
security for SIP-signaled SRTP at the meeting in Buenos Aires. Here is a 
proposed draft charter[1] for a SIPBRANDY working group to progress that 
work. Gonzalo Camarillo has agreed to chair the group, if formed.

Please send comments (positive or negative) about the proposed charter 
to the dispatch working list as soon as possible.

[1] https://datatracker.ietf.org/doc/charter-ietf-sipbrandy/

Thanks!

Ben.

---

From: "Asveren, Tolga" <[email-masked]>
Date: Wed, 18 May 2016 06:40:22 +0000

i- "The SIPBRANDY working group will define best practices for establishing
two-party, SIP-signaled SRTP sessions with end-to-end security
associations, including a single, preferred SRTP key exchange mechanism."
I think this is an area, where in the past there were repeated half-hearted/failed (at least in practice) attempts and statuesque prevailed. *If* the reality on the ground is to be considered as well -rather than just a theoretically perfect "solution"-, I think it is worth to give it another try.

ii- "The working group will additionally coordinate with the MMUSIC working
group to define opportunistic security [RFC 7435] for SIP-signaled media 
sessions for situations where strong protections are not necessary or not"
feasible."
IMHO, this is important, shouldn't be too difficult to converge on a solution and would have great practical value.

I would be willing to contribute -in one way or another- for both.

Thanks,
Tolga

> -----Original Message-----
> From: dispatch [mailto:[email-masked]] On Behalf Of Ben
> Campbell
> Sent: Tuesday, May 17, 2016 5:29 PM
> To: DISPATCH <[email-masked]>
> Cc: [email-masked]; ART ADs <[email-masked]>; Russ Housley
> <[email-masked]>; Gonzalo Camarillo
> <[email-masked]>; Richard Barnes <[email-masked]>
> Subject: [dispatch] Proposed SIPBRANDY Charter
> 
> Hi,
> 
> Please send comments (positive or negative) about the proposed charter to
> the dispatch working list as soon as possible.
> 
> _______________________________________________
> dispatch mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dispatch

---

From: Paul Kyzivat <[email-masked]>
Date: Thu, 19 May 2016 17:23:42 -0400

> work. Gonzalo Camarillo has agreed to chair the group, if formed.

I didn't hear the BA discussions, so I'm shooting blind here.

Is there any intention for this to yield something that can be 
interworked with webrtc (one webrtc endpoint, one sip endpoint) while 
still getting e2e SRTP?

If so, that ought to be stated because it will constrain the solution space.

	Thanks,
	Paul

---

From: "Ben Campbell" <[email-masked]>
Date: Thu, 19 May 2016 17:34:51 -0500

> If so, that ought to be stated because it will constrain the solution 

I don't recall it being discussed, at least not explicitly. Or maybe I 
just forgot. What do people think?

---

From: "Hutton, Andrew" <[email-masked]>
Date: Fri, 20 May 2016 10:57:30 +0000

> If so, that ought to be stated because it will constrain the solution

I also don't think this was discussed in the meeting but I would support having it stated as a goal.

Andy

---

From: "Hutton, Andrew" <[email-masked]>
Date: Fri, 20 May 2016 11:14:12 +0000

The draft charter states:

"The SIPBRANDY working group will define best practices for establishing two-party, SIP-signaled SRTP sessions with end-to-end security associations, including a single, preferred SRTP key exchange mechanism".

I understand that the PERC working group is working on the multi-party case but it is I think strange to start this work with the assumption that it only relates to two-party calls. From a SIP endpoint perspective it cannot know when it initiates a session whether it is going to be a two-party or multi-party session or that a two-party session will not transition to multi-party.

Therefore the work of this group needs to be coordinated in some way with the work of the PERC group to make sure that the outputs from these working groups results in solutions which are not incompatible and I think this needs to be in the charter.

At a minimum PERC should be added to the groups that SIPBRANDY closely collaborates with but I would also like to see something added to the SIPBRANDY objectives to state that the solution needs to compatible with PERC meaning that SIP endpoints can support both and don't need prior knowledge of which will be used in a session. 

By the way it might also be necessary to update the PERC charter to say something similar about SIPBRANDY.

Regards
Andy

> Sent: 17 May 2016 22:29
> To: DISPATCH
> Cc: [email-masked]; ART ADs; Russ Housley; Gonzalo Camarillo;
> Richard Barnes

---

From: Adam Roach <[email-masked]>
Date: Fri, 20 May 2016 16:13:11 -0500

> just forgot. What do people think?

I would definitely support it. I also think it's pretty likely we'll end 
up there without really trying. In many ways, WebRTC took lessons 
learned from earlier VoIP efforts, and tried to identify "actual best 
practices": the use of ICE for consent-to-receive; the use of DTLS-SRTP 
for more secure key management; etc.

But I believe that making it an explicit goal would be good.

/a