Re: [AVT] Sound level indicators

["Jonathan Lennox" <jonathan at vidyo.com>]

Enrico Marocco [mailto:enrico.marocco at telecomitalia.it] writes: 


> I may have not given enough thought to all the side issues, but it 
> seems to me that the two drafts deal with the very same kind of
> information (and thus its encoding should be specified in only one
> place).

I absolutely agree that these drafts should be aligned as closely as
possible.

I also agree that standardizing encoding is a good idea -- this is why
my draft copies its definition and encoding of audio level from the
Comfort Noise payload. 

I'd be open to combining the two drafts, if the WG agrees that both
issues are worth working on, and feels that having a single document
addressing multiple issues is better than having two documents that
inevitably repeat or cross-reference information.

(Technically, I believe that having separate extension headers for "ssrc
level" and "csrc levels" is a good idea, but that's orthogonal to the
issue of document structure.)

> To me, the main issue with passing the sound level of a non-mixed
> stream to do with the fact that the RTP header is not going to be
> encrypted when using SRTP: an in-line attacker could mute a
> conference participant just mangling such value or, if the header
> is integrity protected, dropping those packets where voice activity
> is reported.

I'm not so worried about the first point -- SRTP strongly disrecommends
using encryption without authentication (which covers headers), and any
environment in which you're not willing to pay for the bandwidth
overhead of SRTP authentication is probably one in which you're not
willing to have extension headers either.

The second point is more of an issue, but the issue I'm most concerned
about is the fact (with either draft) that a passive attacker can see a
real-time waveform (at ptime resolution) of a participant's, or each
participant's, audio.

I've been pondering an SRTP extension to encrypt selected extension
headers; I think this might end up being necessary for both of these
drafts.

-- 
Jonathan Lennox
Vidyo, Inc
jonathan at vidyo.com