Subject: Re: [secdir] SECDIR review of draft-worley-service-example-13

From: [email-masked] (Dale R. Worley)
Date: Mon, 16 Sep 2013 17:37:03 -0400 (EDT)

This is a report on changes to draft-worley-service-example (to
produce draft-worley-service-example-14) in response to the SECDIR
review by Stephen Kent.

> Date: Thu, 22 Aug 2013 11:51:28 -0400
> From: Stephen Kent <[email-masked]>

> This document describes how to provide music on old (MOH) in a VoIp 
> environment, an obviously critical capability needed to preserve feature 
> compatibility with the PSTN. Callers who are not subjected to MOH might 
> otherwise not be exposed to classical music, in many contexts, a tragic 
> outcome.

Unfortunately, the real market driver for MOH is businesses that want
to play ads to you while you are waiting on hold to talk to a human.
Creating a facility to allow these businesses to do what they want
might be considered as violating the "Do no evil." principle, but it
does seem to be critical in the marketplace.

> I was surprised to see that all the references to RFCs (normative
> and informative) use labels other than RFC numbers. This an unusual
> convention that I hope the RFC editor will fix.

Personally, I find it a lot more convenient to tag RFCs by their
topics than their numbers, as I don't remember the numbers of more
than a handful of RFCs.  Nonetheless, using RFC numbers as tags is the
convention these days, and I've updated the draft to do the same.

> It is hard to overstate the importance of appropriate security 
> mechanisms for this critical aspect of VoIP. Consistent with this 
> observation, the Security Considerations section of this document 
> consists of just one paragraph. The paragraph addresses one security 
> concern, i.e., the ability of the UA of a caller to filter incoming 
> media based on the address of the source of the media. The design in 
> this document provides the source address of the MOH server, via SDP (in 
> a re-INVITE), to the caller who is on hold, and thus satisfies this concern.
> 
> In a more serious vein, I'd like to see the Security Considerations 
> section mention whether UAs are expected to use SDP and SIP security 
> mechanisms for MOH, IF these mechanisms were employed for the original 
> call. Another paragraph could be added to discuss the desirability of 
> maintaining an equivalent level of security when a caller is switched 
> over to MOH, and to cite the relevant RFCs, or to explain why this is 
> not appropriate.

I've expanded the draft in this regard.  The new text is:

    5.  Security Considerations

    5.1.  SIP (signaling) security

       The executing UA and the MOH server will usually be within the same
       administrative domain and the SIP signaling path between them will
       lie entirely within that domain.  In this case, the administrator of
       the domain should configure the UA and server to apply to to the
       dialog between them a level of security that is appropriate for the
       administrative domain.

       If the executing UA and the MOH server are not within the same
       administrative domain, the SIP signaling between them should be at
       least as secure as the SIP signaling between the executing UA and the
       remote UA.  Thus, the MOH server should support all of the SIP
       security facilities that are supported by the executing UA, and the
       executing UA should use in its dialog with the MOH server all SIP
       security facilities that are used in its dialog with the remote UA.

    5.2.  RTP (media) security

       The RTP for the MOH media will pass directly between the MOH server
       and the remote UA, and thus may pass outside the administrative
       domain of the executing UA.  While it is uncommon for the contents of
       the MOH media to be sensitive (and the remote UA will not usually be
       generating RTP when it is on-hold), the MOH RTP should be at least as
       secure as the RTP between the executing UA and the remote UA.  In
       order to make this possible, the MOH server should support all of the
       RTP security facilities that are supported by the executing UA.

       It is possible that the remote UA and the MOH server support an RTP
       security facility that the executing UA does not support, and that it
       is desirable to use this facility for the MOH RTP.  To enable this,
       the executing UA should the SDP between the remote UA and the MOH
       server completely, not omitting elements that it does not understand.

    5.3.  Media filtering

       Some UAs filter incoming RTP based on the address of origin as a
       media security measure.  The remote UA in the original dialog may use
       this media filtering, and if the executing UA does not update the SDP
       to inform the remote UA of the source address of the MOH media, the
       remote UA may not render the MOH media.  Note that the executing UA
       has no means for detecting that the remote UA uses media filtering,
       so the executing UA must assume that any remote UA uses media
       filtering.

       The technique described in this document ensures that any UA that
       should render MOH media will be informed of the source address of the
       media via the SDP that it receives.  This allows such UAs to filter
       media without interfering with MOH operation.

Dale