Subject: [rtcweb] A couple of questions on SDP Identity attribute

From: Christer Holmberg <[email-masked]>
Date: Thu, 11 Oct 2018 07:23:53 +0000

Hi,

A couple of questions related to some comments on GitHub:

Q1: In an offer or answer, it allowed to include fingerprints that have NOT been used to assert the identity?

Q2: If one or more of the fingerprints used to assert the identity change, I assume that the Identity attribute value will always changes a result? Or, is there a chance that different fingerprints would produce the same Identity attribute value?

Regards,

Christer

---

From: Harald Alvestrand <[email-masked]>
Date: Thu, 11 Oct 2018 13:01:57 +0200

> NOT been used to assert the identity?

I don't understand the question..... if you don't assert an identity,
there are of course fingerprints that have not been used to assert the
identity.

Was the question about the case where you include an identity attribute?

> 
>  
> 
> Q2: If one or more of the fingerprints used to assert the identity
> change, I assume that the Identity attribute value will always changes a
> result? Or, is there a chance that different fingerprints would produce
> the same Identity attribute value?

A fingerprint can't really "change".
There may be new fingerprints because of new hash functions added
(though that would be strange over the time of a call), or because new
certificates were added to the session.

> 
>  
> 
> Regards,
> 
>  
> 
> Christer
> 
>  
> 
>  
> 
> 
> 
> _______________________________________________
> rtcweb mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/rtcweb
>

---

From: Christer Holmberg <[email-masked]>
Date: Thu, 11 Oct 2018 11:27:06 +0000

Hi,

    > Was the question about the case where you include an identity attribute?
    
    Yes.

    > certificates were added to the session.
    
    Correct.

    Regards,

    Christer

---

From: Cullen Jennings <[email-masked]>
Date: Thu, 11 Oct 2018 14:57:17 -0600

> On Oct 11, 2018, at 12:23 AM, Christer Holmberg <[email-masked]> wrote:
> 
> Hi,
>  

Yes, I think they should because fingerprints can be used even if Identity is not. 

> Q2: If one or more of the fingerprints used to assert the identity change, I assume that the Identity attribute value will always changes a result? Or, is there a chance that different fingerprints…

It will pretty much always changes ( or at least at the same odds of two different things hashing to the same value ) 

If the far end was doing transfers that looked like just changing the SDP in the same offer/answer session to move the media to a new endpoint, the fingerprint and identity values would change but it would also be redoing ICE and setting up a new DTLS session. 

> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/rtcweb <https://www.ietf.org/mailman/listinfo/rtcweb>

---

From: Christer Holmberg <[email-masked]>
Date: Sat, 13 Oct 2018 17:34:06 +0000

Hi,

>Yes, I think they should because fingerprints can be used even if Identity is not.

In that case, I think the following text (Section 5.4.6.1.) is wrong:

   "The identity attribute attests to all "a=fingerprint" attributes in
   the session description.  It is therefore a session-level attribute.

   Multiple "a=fingerprint" values can be used to offer alternative
   certificates for a peer.  The "a=identity" attribute MUST include all
   fingerprint values that are included in "a=fingerprint" lines of the
   session description."

In my opinion it clearly states that every fingerprint attribute is associated with the identity attribute, and it is not allowed to include fingerprint attributes that are not associated with the identity attribute.

Regards,

Christer

---

From: Christer Holmberg <[email-masked]>
Date: Thu, 18 Oct 2018 10:30:06 +0000

Any comments?

Regards,

Christer

________________________________
From: rtcweb <[email-masked]> on behalf of Christer Holmberg <[email-masked]>
Sent: Saturday, October 13, 2018 8:34 PM
To: Cullen Jennings
Cc: RTCWeb IETF
Subject: Re: [rtcweb] A couple of questions on SDP Identity attribute

Hi,

Regards,

Christer