Subject: [rtcweb] Identity assertion: impact by removal or adding of fingerprints?

From: Christer Holmberg <[email-masked]>
Date: Mon, 13 Aug 2018 06:29:55 +0000

Hi,

One thing that came to my mind when working on the SDP Identity attribute pull request.

In WebRTC, and in the draft, we assume that the identity assertion is bound to the fingerprints.

What if fingerprints are removed, or added, during a session. Will that impact the identity assertion?

A fingerprint can be removed if it is only used for one m- section, and that m- section is disabled.

Regards,

Christer

---

From: Martin Thomson <[email-masked]>
Date: Mon, 13 Aug 2018 16:35:19 +1000

Unused fingerprints aren't a problem.  a=fingerprint offers multiple
options, any of which could be used.  The a=identity attribute is no
different.  If a fingerprint is authenticated, but not used, that's OK
as long as the ones that are used are covered.

If a new fingerprint is added, that's OK, as long as the a=identity
previously covered that value, or is amended to include the new value.
On Mon, Aug 13, 2018 at 4:30 PM Christer Holmberg
<[email-masked]> wrote:
> _______________________________________________
> rtcweb mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/rtcweb

---

From: Christer Holmberg <[email-masked]>
Date: Mon, 13 Aug 2018 07:23:35 +0000

Hi,

>as long as the ones that are used are covered.

That may require a little re-wording, because I think the text now says
that each fingerprint that was used to create the assertion must always be
included in offers and answers.

>previously covered that value,

That may not be true if one e.g., adds a new m- section with a fingerprint
that has not previously been used.

>or is amended to include the new value.

How does that work?

Regards,

Christer

---

From: Christer Holmberg <[email-masked]>
Date: Wed, 15 Aug 2018 06:25:02 +0000

Hi,

One possibility would be to say that an endpoint is not allowed to add a
new fingerprint (that hasn¹t been used before within the session), if
updating of the identity assertion is not supported.

Is it possible to use the same fingerprint for multiple m- lines, even if
they are not bundled?

Regards,

Christer

On 13/08/18 10:23, "rtcweb on behalf of Christer Holmberg"
<[email-masked] on behalf of [email-masked]>

---

From: Martin Thomson <[email-masked]>
Date: Wed, 15 Aug 2018 16:50:16 +1000

The assertion can change, it's the identity that results that can't
change (in WebRTC, and likely many other cases).
On Wed, Aug 15, 2018 at 4:25 PM Christer Holmberg

---

From: Christer Holmberg <[email-masked]>
Date: Wed, 15 Aug 2018 07:10:25 +0000

Hi,

>change (in WebRTC, and likely many other cases).

Ok. My understanding was that in WebRTC the PC cannot communicate with the
IdP in order to create a new assertion (e.g., when a new fingerprint has
been added), even with the same identity, but I’m glad if I was wrong :)

Regards,

Christer

>> >>> In WebRTC, and in the draft, we assume that the identity assertion
>>is
>> >>>bound to the fingerprints.
>> >>>
>> >>> What if fingerprints are removed, or added, during a session. Will
>>that
>> >>>impact the identity assertion?
>> >>>
>> >>> A fingerprint can be removed if it is only used for one m- section,
>>and
>> >>>that m- section is disabled.
>> >>>
>> >>> Regards,
>> >>>
>> >>> Christer

---

From: Martin Thomson <[email-masked]>
Date: Wed, 15 Aug 2018 17:19:34 +1000

> been added), even with the same identity, but I’m glad if I was wrong :)

In Firefox, I don't think that you can change or add fingerprints, so
the question is a little hard to answer so simply.  However, the IdP
is consulted every time a session description (offer or answer) is
created.