Re: [AVT] SSRC to DTLS-SRTP mapping

[Colin Perkins <csp at csperkins.org>]

On 19 Feb 2008, at 23:03, Dan Wing wrote:
>> On 19 Feb 2008, at 17:21, Dan Wing wrote:
>> ...
>>> However, I am worried about an attack flooding a device and causing
>>> the device to perform SHA1 operations, when it seems we could
>>> communicate the SSRC in the DTLS exchange (handshake or separate
>>> message), and/or use source address verification to help protect
>>> devices from such an attack.
>>>
>>> If it's only me that has this concern, I will sit back down in my
>>> chair.
>>
>> I see the concern, but I think this has to work in the general case,
>> without signalling support (except the DTLS handshake). I have no
>> problem with there being optimisations possible in those cases where
>> the SSRC to host/port pair mapping can be signalled out of band
>> though, since there will certainly be scenarios where that's  
>> possible.
>
> Would dropping a DTLS packet on the floor if its source IP address and
> port are different from the DTLS handshake be acceptable?


Yes, I think so. Why do you think it might not be?

-- 
Colin Perkins
http://csperkins.org/


_______________________________________________
Audio/Video Transport Working Group
avt at ietf.org
http://www.ietf.org/mailman/listinfo/avt