Re: [AVT] SSRC to DTLS-SRTP mapping

["Dan Wing" <dwing at cisco.com>]

> > > Would dropping a DTLS packet on the floor if its source 
> IP address and
> > > port are different from the DTLS handshake be acceptable?
> > 
> > 
> > Yes, I think so. Why do you think it might not be?
> 
> Dan, do you really mean "DTLS packet" or do you mean "SRTP Packet"?

Thanks for catching that.

Yes, I meant:  would it be acceptable to drop an SRTP packet on the 
floor if its source IP address and port are different from the 
DTLS handshake.

> Because I think the answer is different for DTLS is "yes" but
> SRTP is "no"--again, unless I've badly misunderstood RTP,
> which is totally possible.

What I am trying to understand if a single DTLS-SRTP handshake
between two hosts is really supposed to be able to provide the key 
for any ol' SRTP packet that might happen to arrive on that host's
IP address and port.  I agree RTP works that way.

I find it risky to have SRTP work that way, because no other
security protocol has the receiver run a MAC without first 
doing a simple comparison on some other field (IPsec SPI, source
address of the packet, TCP sequence number, etc....).  

It is a new risk for SRTP to do this.

-d

_______________________________________________
Audio/Video Transport Working Group
avt at ietf.org
http://www.ietf.org/mailman/listinfo/avt