Subject: [Secdispatch] Multicast Security and Privacy Considerations

From: Kyle Rose <[email-masked]>
Date: Fri, 6 Aug 2021 19:44:21 -0400

Secdispatch participants:

Across two SDOs (IETF and W3C), multiple parties have begun to look into
how to make multicast safe within the Web security model. As part of this
effort, Jake Holland and I have been putting together a security and
privacy considerations document for multicast, akin to that for WebRTC (RFC
8826), that attempts to identify where multicast inherently differs from
unicast in usage patterns and protocol constraints, and then lays out a set
of requirements for multicast protocols that we believe would allow them to
fit within the spirit of the Web security model. From the abstract:

> Interdomain multicast has unique potential to solve delivery scalability
for popular content, but it carries a set of security and privacy issues
that differ from those in unicast delivery. This document analyzes the
security threats unique to multicast-based delivery for Internet and Web
traffic under the Internet and Web threat models.

We come to secdispatch primarily with the aim of finding a venue within the
IETF in which to continue to flesh out and improve this work. Considering
the potential security and privacy implications for browsers of introducing
a model for content delivery that in many ways fundamentally differs from
that provided by existing unicast transports, we are especially interested
in the question of whether this fits into any existing working groups
(whether in the security area or otherwise) or would necessitate a new
group, such as a reopening of MSEC. Of course, any helpful feedback is
welcomed.

The draft and associated GitHub repo can be found here:

https://datatracker.ietf.org/doc/draft-krose-multicast-security/
https://github.com/squarooticus/draft-krose-multicast-security

Thanks,
Kyle (and Jake)