Subject: [rtcweb] #42 (security-arch): Idp for RTP And RTCP

From: "rtcweb issue tracker" <[email-masked]>
Date: Wed, 25 Mar 2015 19:13:31 -0000

#42: Idp for RTP And RTCP

 Back in July, the following question was raised:
 http://www.ietf.org/mail-archive/web/rtcweb/current/msg12643.html

 Martin suggested a resolution here:
 http://www.ietf.org/mail-archive/web/rtcweb/current/msg12644.html

-- 
-------------------------------------+-------------------------------------
 Reporter:                           |      Owner:  draft-ietf-rtcweb-
  [email-masked]          |  [email-masked]
     Type:  defect                   |     Status:  new
 Priority:  major                    |  Milestone:  milestone1
Component:  security-arch            |    Version:  1.0
 Severity:  In WG Last Call          |   Keywords:
-------------------------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/rtcweb/trac/ticket/42>
rtcweb <http://tools.ietf.org/rtcweb/>

---

From: Roman Shpount <[email-masked]>
Date: Fri, 3 Apr 2015 12:28:07 -0400

Where is the use of multiple fingerprint attributes per single m=line is
defined?
RFC 4572 is written in such a way that only one fingerprint per m= line can
be present.

_____________
Roman Shpount

On Wed, Mar 25, 2015 at 3:13 PM, rtcweb issue tracker <
[email-masked]> wrote:

> _______________________________________________
> rtcweb mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/rtcweb
>

---

From: Martin Thomson <[email-masked]>
Date: Fri, 3 Apr 2015 10:00:47 -0700

> RFC 4572 is written in such a way that only one fingerprint per m= line can

I don't think that's right.  4572 only requires the fingerprint to
match the hash used in the certificate signature.  If you have
multiple certificates, then you are ok.

As we discussed in the meeting, we are going to need to update 4572.
The requirement I mention is bogus anyway.

---

From: Suhas Nandakumar <[email-masked]>
Date: Fri, 3 Apr 2015 14:57:12 -0700

On Fri, Apr 3, 2015 at 10:00 AM, Martin Thomson <[email-masked]>
wrote:

> I agree that RFC4572 doesn't say against using multiple fingerprints
except for saying how it is generated as Martin suggested. I don't think
RFC4572 needs to be updated either for this...

---

From: Roman Shpount <[email-masked]>
Date: Fri, 3 Apr 2015 22:54:11 -0400

> RFC4572 needs to be updated either for this...
It does not say anything about how multiple fingerprints should work
either, i.e. it does not say that only one needs to match. I agree that
this is logical, but I do not think it is mentioned anywhere.
_____________
Roman Shpount