Re: [AVT] SSRC to DTLS-SRTP mapping

["Dan Wing" <dwing at cisco.com>]

> On 19 Feb 2008, at 17:21, Dan Wing wrote:
> ...
> > However, I am worried about an attack flooding a device and 
> causing  
> > the device to perform SHA1 operations, when it seems we could  
> > communicate the SSRC in the DTLS exchange (handshake or separate  
> > message), and/or use source address verification to help protect  
> > devices from such an attack.
> >
> > If it's only me that has this concern, I will sit back down in my  
> > chair.
> 
> I see the concern, but I think this has to work in the general case,  
> without signalling support (except the DTLS handshake). I have no  
> problem with there being optimisations possible in those cases where  
> the SSRC to host/port pair mapping can be signalled out of band  
> though, since there will certainly be scenarios where that's possible.

Would dropping a DTLS packet on the floor if its source IP address and 
port are different from the DTLS handshake be acceptable?

-d

_______________________________________________
Audio/Video Transport Working Group
avt at ietf.org
http://www.ietf.org/mailman/listinfo/avt