Subject: [rtcweb] Unique credentials for non-bundled m-lines

From: Eric Rescorla <[email-masked]>
Date: Sun, 11 May 2014 17:55:41 -0700

https://github.com/rtcweb-wg/jsep/issues/17

JSEP S 5.2.1 reads:

Each m= section, provided it is not being bundled into another m=
section, MUST generate a unique set of ICE credentials and gather its
own unique set of ICE candidates. Otherwise, it MUST use the same ICE
credentials and candidates that were used in the m= section that it is
being bundled into.

But Section 15.4 of ICE explicitly permits m-lines to share
credentials, and of course ICE knows nothing of BUNDLE:

The "ice-pwd" and "ice-ufrag" attributes can appear at either the
session-level or media-level. When present in both, the value in the
media-level takes precedence. Thus, the value at the session-level is
effectively a default that applies to all media streams, unless
overridden by a media-level value. Whether present at the session or
media-level, there MUST be an ice-pwd and ice-ufrag attribute for each
media stream. If two media streams have identical ice-ufrag's, they
MUST have identical ice-pwd's.

Is there a reason for requiring unique credentials? If not I suggest
we remove this requirement.

-Ekr

---

From: Cullen Jennings <[email-masked]>
Date: Sat, 17 May 2014 13:30:38 -0500

> we remove this requirement.

When not doing bundle, is there any problems in the consent security with shared credential? If not, seems like we should remove this.

---

From: Christer Holmberg <[email-masked]>
Date: Sun, 18 May 2014 09:56:28 +0000

Hi,

> not, seems like we should remove this.

I guess that would mean that different BUNDLE groups could share the same credentials also?

Regards,

Christer

---

From: Justin Uberti <[email-masked]>
Date: Sun, 18 May 2014 20:56:55 -0700

I think this dated back to when BUNDLE used the same ports from the
beginning, and this was needed for demultiplexing or somesuch.

As it stands now, the main value here is that a unique ufrag+pwd provides a
nice lookup handle to identify an ICE session, which might be useful for
stats.

On Sun, May 18, 2014 at 2:56 AM, Christer Holmberg <
[email-masked]> wrote:

> > When not doing bundle, is there any problems in the consent security
> with shared credential? If
> > not, seems like we should remove this.
>
> _______________________________________________
> rtcweb mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/rtcweb
>