Subject: [Sframe] charter feedback

From: Franziskus Kiefer <[email-masked]>
Date: Fri, 4 Sep 2020 12:23:08 +0200

Hi all,

First, thanks for working on this.
Wire is currently considering sframe for some use cases.

Looking at the charter I noticed two things:

The charter currently doesn't talk about authentication and to which extent
the WG wants to look at it. While authenticity might be implicit through
the used keys the sframe draft currently also uses signatures.

I'm missing a statement about the process followed by the WG. End-to-end
encrypted conferencing is a relatively new topic without much research
around threat models. I therefore think that a process that validates the
threat model and the proposed solution is warranted. This might not have
the same extent as for TLS or MLS, but would still be good to have.

Cheers,
Franziskus

---

From: Alexandre GOUAILLARD <[email-masked]>
Date: Fri, 4 Sep 2020 19:23:21 +0800

Hi franz.,

Thank you for your interest and the kind words.

"Conferencing" is certainly a topic of interest, and i understand the focus
of wire. SFrame can certainly be used in that context.

However, there are other use cases than conferencing where media encryption
is of interest, including but not limited to streaming/broadcasting and
then of course all the hybrid use cases we start seeing emerging (watch
parties, webinars, ....).

We designed SFrame itself to refer ONLY to the media encryption part, and
be as much as possible media transport agnostic, and use case/threat
model/trust model agnostic, where the precedent attempt was extremely
focussed on RTP-based conferencing.

Eventually, each use case (e.g. conferencing) should have
additional documents to come up to a full system whose properties could be
verified, but we did not want to restrict the charter to a single use case.

Right now, emad is working on the conferencing use case with sergio, and
you might want to liaise with them on that specific topic. One document
about how SFrame can be used with RTP, and, seprately, with MLS including
the corresponding threat model is in progress. I think this is what you are
looking for.

In parallel, work is being done on application to SFrame for
streaming/broadcasting and how it relates/overlaps with existing DRM
solutions today in the bigger context. This will also hopefully have its
own set of document. EVentually all would have the media encryption,
SFrame, in common.

Hope this helps.

On Fri, Sep 4, 2020 at 6:23 PM Franziskus Kiefer <[email-masked]>
wrote:

> The charter currently doesn't talk about authentication and to which
> extent the WG wants to look at it. While authenticity might be implicit
> through the used keys the sframe draft currently also uses signatures.
>
> --
> Sframe mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sframe
>

---

From: Franziskus Kiefer <[email-masked]>
Date: Fri, 4 Sep 2020 14:15:37 +0200

Hi Alexandre,

thanks for the response.
I totally agree that the charter shouldn't restrict the use cases here.
Conferencing was really meant as an example (bad phrasing on my side,
though it's of course an important use case for us).
But the charter can set out the process taken by the WG. And all use cases
here should profit from this (i.e. making sure that the threat modeling and
solution for each use case are vetted by other parties, in particular
academia).

I currently only know about https://github.com/eomara/sframe. Is there any
other draft in progress?

Best,
Franziskus

On Fri, 4 Sep 2020 at 13:23, Alexandre GOUAILLARD <
[email-masked]> wrote:

> "Conferencing" is certainly a topic of interest, and i understand the
> focus of wire. SFrame can certainly be used in that context.
>
> However, there are other use cases than conferencing where media
> encryption is of interest, including but not limited to
> streaming/broadcasting and then of course all the hybrid use cases we start
> seeing emerging (watch parties, webinars, ....).
>
> On Fri, Sep 4, 2020 at 6:23 PM Franziskus Kiefer <
> [email-masked]> wrote:
>
>> Hi all,
>>

---

From: Alexandre GOUAILLARD <[email-masked]>
Date: Fri, 4 Sep 2020 20:22:05 +0800

> solution for each use case are vetted by other parties, in particular

I think our goals are aligned.

> I currently only know about https://github.com/eomara/sframe. Is there
> any other draft in progress?
>

Yes. You might want to contact emad separately to know the status of this.