[Simple] ACM and comedia [was RE: MSRP-ACM compatibility]

["Christer Holmberg" <christer.holmberg at ericsson.com>]

Hi,

>>>>FIRST, RFC4572 already defines the usage of the fingerprint
attribute,
>>>>so wouldn't your issue also apply if you ONLY use COMEDIA, with
relays?
>>>
>>>If you use COMEDIA-TLS, yes. Not if just use RFC4145, or follow
_just_
>>>the connection-direction parts of the ACM draft.
>>
>>Chapter 4.1.2, which belongs to the comedia part of the ACM draft, 
>>does refer to RFC4572, so my assumption so far has been that "using 
>>the comedia part" would also include RFC4572 for TLS.
>>
>>So, when talking about comedia, I guess we need to separate between 
>>"using the comedia part" (which, for TLS, includes the fingerprint
>>attribute) and "using just the connection-direction parts of comedia".
>>
>>And, even without the fingerprint, you still have the TLS collision 
>>issue if both endpoints are "active".
> 
>Ah, I see what you mean. I agree, the issue with using 
>fingerprints for relay certificates is true just for the 
>COMEDIA use currently defined in the ACM draft.

There are actually a number of comedia issues, but it seems like I have
mixed them. I'll try to separate them:

FIRST, if we don't use the fingerprint attribute when the MSRP clients
use self-signed signatures, we are not compliant with RFC4572. Do we
want to go that way? Do we have the mandate to go that way? Will the
security people have issues with that? 

Without relays I guess there would be no issue with using the
fingerprint attribute (again, I am only talking about pure comedia here
- not SBC impacts etc). But, even with relays, I guess it would be
possible to provide the fingerprint of the remote client to the relay
e.g. using the AUTH method. 


SECOND, the handshake collision occurs when both endpoints are "active".
AFAIK, that has nothing to do with whether the fingerprint is used or
not.


THIRD (new), I assume an MSRP entity behind a relay would always be
"active". I am not sure whether that is an issue, but it should probably
be mentioned in the draft.


Regards,

Christer