Diff: draft-ietf-sipbrandy-rtpsec-02.txt - draft-ietf-sipbrandy-rtpsec-03.txt

	< draft-ietf-sipbrandy-rtpsec-02.txt	draft-ietf-sipbrandy-rtpsec-03.txt >

	Network Working Group J. Peterson	Network Working Group J. Peterson
	Internet-Draft Neustar	Internet-Draft Neustar
	Intended status: Best Current Practice E. Rescorla	Intended status: Best Current Practice E. Rescorla

	Expires: September 14, 2017 R. Barnes	Expires: May 3, 2018 R. Barnes
	Mozilla	Mozilla
	R. Housley	R. Housley
	Vigilsec	Vigilsec

	March 13, 2017	October 30, 2017

	Best Practices for Securing RTP Media Signaled with SIP	Best Practices for Securing RTP Media Signaled with SIP

	draft-ietf-sipbrandy-rtpsec-02.txt	draft-ietf-sipbrandy-rtpsec-03.txt

	Abstract	Abstract

	Although the Session Initiation Protocol (SIP) includes a suite of	Although the Session Initiation Protocol (SIP) includes a suite of
	security services that has been expanded by numerous specifications	security services that has been expanded by numerous specifications
	over the years, there is no single place that explains how to use SIP	over the years, there is no single place that explains how to use SIP
	to establish confidential media sessions. Additionally, existing	to establish confidential media sessions. Additionally, existing
	mechanisms have some feature gaps that need to be identified and	mechanisms have some feature gaps that need to be identified and
	resolved in order for them to address the pervasive monitoring threat	resolved in order for them to address the pervasive monitoring threat
	model. This specification describes best practices for negotiating	model. This specification describes best practices for negotiating

	skipping to change at page 1, line 36 ¶	skipping to change at page 1, line 36 ¶
	opportunistic security solutions.	opportunistic security solutions.

	Status of This Memo	Status of This Memo

	This Internet-Draft is submitted in full conformance with the	This Internet-Draft is submitted in full conformance with the
	provisions of BCP 78 and BCP 79.	provisions of BCP 78 and BCP 79.

	Internet-Drafts are working documents of the Internet Engineering	Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF). Note that other groups may also distribute	Task Force (IETF). Note that other groups may also distribute
	working documents as Internet-Drafts. The list of current Internet-	working documents as Internet-Drafts. The list of current Internet-

	Drafts is at http://datatracker.ietf.org/drafts/current/.	Drafts is at https://datatracker.ietf.org/drafts/current/.

	Internet-Drafts are draft documents valid for a maximum of six months	Internet-Drafts are draft documents valid for a maximum of six months
	and may be updated, replaced, or obsoleted by other documents at any	and may be updated, replaced, or obsoleted by other documents at any
	time. It is inappropriate to use Internet-Drafts as reference	time. It is inappropriate to use Internet-Drafts as reference
	material or to cite them other than as "work in progress."	material or to cite them other than as "work in progress."


	This Internet-Draft will expire on September 14, 2017.	This Internet-Draft will expire on May 3, 2018.

	Copyright Notice	Copyright Notice

	Copyright (c) 2017 IETF Trust and the persons identified as the	Copyright (c) 2017 IETF Trust and the persons identified as the
	document authors. All rights reserved.	document authors. All rights reserved.

	This document is subject to BCP 78 and the IETF Trust's Legal	This document is subject to BCP 78 and the IETF Trust's Legal
	Provisions Relating to IETF Documents	Provisions Relating to IETF Documents

	(http://trustee.ietf.org/license-info) in effect on the date of	(https://trustee.ietf.org/license-info) in effect on the date of
	publication of this document. Please review these documents	publication of this document. Please review these documents
	carefully, as they describe your rights and restrictions with respect	carefully, as they describe your rights and restrictions with respect
	to this document. Code Components extracted from this document must	to this document. Code Components extracted from this document must
	include Simplified BSD License text as described in Section 4.e of	include Simplified BSD License text as described in Section 4.e of
	the Trust Legal Provisions and are provided without warranty as	the Trust Legal Provisions and are provided without warranty as
	described in the Simplified BSD License.	described in the Simplified BSD License.

	Table of Contents	Table of Contents

	1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2	1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2

	skipping to change at page 8, line 5 ¶	skipping to change at page 8, line 5 ¶
	[I-D.ietf-stir-rfc4474bis] allows the retransmission of requests	[I-D.ietf-stir-rfc4474bis] allows the retransmission of requests
	with repairable error conditions (see section 6.1.1) in a way that	with repairable error conditions (see section 6.1.1) in a way that
	can override that SHOULD in RFC4916. In particular, an	can override that SHOULD in RFC4916. In particular, an
	authentication service MAY retry a mid-dialog as	authentication service MAY retry a mid-dialog as
	[I-D.ietf-stir-rfc4474bis] allows rather than treating the dialog	[I-D.ietf-stir-rfc4474bis] allows rather than treating the dialog
	as terminated, though note that only one such retry is permitted.	as terminated, though note that only one such retry is permitted.

	The examples in RFC4916 are based on the original RFC4474, and	The examples in RFC4916 are based on the original RFC4474, and
	will not match signatures using [I-D.ietf-stir-rfc4474bis].	will not match signatures using [I-D.ietf-stir-rfc4474bis].


	The use of RFC4916 has some further interactions with ICE; see	Future work may be done to revise RFC4916 for STIR; that work should
	Section 7.	take into account any impacts on the profile described in this
		document. The use of RFC4916 has some further interactions with ICE;
		see Section 7.

	4.4. Authorization Decisions	4.4. Authorization Decisions

	[I-D.ietf-stir-rfc4474bis] grants STIR verification services a great	[I-D.ietf-stir-rfc4474bis] grants STIR verification services a great
	deal of latitude when making authorization decisions based on the	deal of latitude when making authorization decisions based on the
	presence of the Identity header field. It is largely a matter of	presence of the Identity header field. It is largely a matter of
	local policy whether an endpoint rejects a call based on absence of	local policy whether an endpoint rejects a call based on absence of
	an Identity header field, or even the presence of a header that fails	an Identity header field, or even the presence of a header that fails
	an integrity check against the request.	an integrity check against the request.


	skipping to change at page 11, line 23 ¶	skipping to change at page 11, line 23 ¶
	This document describes the security features that provide media	This document describes the security features that provide media
	sessions established with SIP with confidentiality, integrity, and	sessions established with SIP with confidentiality, integrity, and
	authentication.	authentication.

	12. Informative References	12. Informative References

	[I-D.ietf-ice-rfc5245bis]	[I-D.ietf-ice-rfc5245bis]
	Keranen, A., Holmberg, C., and J. Rosenberg, "Interactive	Keranen, A., Holmberg, C., and J. Rosenberg, "Interactive
	Connectivity Establishment (ICE): A Protocol for Network	Connectivity Establishment (ICE): A Protocol for Network
	Address Translator (NAT) Traversal", draft-ietf-ice-	Address Translator (NAT) Traversal", draft-ietf-ice-

	rfc5245bis-08 (work in progress), December 2016.	rfc5245bis-14 (work in progress), October 2017.

	[I-D.ietf-mmusic-trickle-ice-sip]	[I-D.ietf-mmusic-trickle-ice-sip]
	Ivov, E., Stach, T., Marocco, E., and C. Holmberg, "A	Ivov, E., Stach, T., Marocco, E., and C. Holmberg, "A
	Session Initiation Protocol (SIP) usage for Trickle ICE",	Session Initiation Protocol (SIP) usage for Trickle ICE",

	draft-ietf-mmusic-trickle-ice-sip-07 (work in progress),	draft-ietf-mmusic-trickle-ice-sip-10 (work in progress),
	March 2017.	October 2017.

	[I-D.ietf-stir-certificates]	[I-D.ietf-stir-certificates]
	Peterson, J. and S. Turner, "Secure Telephone Identity	Peterson, J. and S. Turner, "Secure Telephone Identity
	Credentials: Certificates", draft-ietf-stir-	Credentials: Certificates", draft-ietf-stir-

	certificates-11 (work in progress), October 2016.	certificates-14 (work in progress), May 2017.

	[I-D.ietf-stir-passport]	[I-D.ietf-stir-passport]
	Wendt, C. and J. Peterson, "Personal Assertion Token	Wendt, C. and J. Peterson, "Personal Assertion Token
	(PASSporT)", draft-ietf-stir-passport-11 (work in	(PASSporT)", draft-ietf-stir-passport-11 (work in
	progress), February 2017.	progress), February 2017.

	[I-D.ietf-stir-rfc4474bis]	[I-D.ietf-stir-rfc4474bis]
	Peterson, J., Jennings, C., Rescorla, E., and C. Wendt,	Peterson, J., Jennings, C., Rescorla, E., and C. Wendt,
	"Authenticated Identity Management in the Session	"Authenticated Identity Management in the Session
	Initiation Protocol (SIP)", draft-ietf-stir-rfc4474bis-16	Initiation Protocol (SIP)", draft-ietf-stir-rfc4474bis-16

	skipping to change at page 12, line 19 ¶	skipping to change at page 12, line 19 ¶
	effort-srtp-01 (work in progress), October 2006.	effort-srtp-01 (work in progress), October 2006.

	[I-D.peterson-acme-telephone]	[I-D.peterson-acme-telephone]
	Peterson, J. and R. Barnes, "ACME Identifiers and	Peterson, J. and R. Barnes, "ACME Identifiers and
	Challenges for Telephone Numbers", draft-peterson-acme-	Challenges for Telephone Numbers", draft-peterson-acme-
	telephone-00 (work in progress), October 2016.	telephone-00 (work in progress), October 2016.

	[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate	[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
	Requirement Levels", BCP 14, RFC 2119,	Requirement Levels", BCP 14, RFC 2119,
	DOI 10.17487/RFC2119, March 1997,	DOI 10.17487/RFC2119, March 1997,

	<http://www.rfc-editor.org/info/rfc2119>.	<https://www.rfc-editor.org/info/rfc2119>.

	[RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston,	[RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston,
	A., Peterson, J., Sparks, R., Handley, M., and E.	A., Peterson, J., Sparks, R., Handley, M., and E.
	Schooler, "SIP: Session Initiation Protocol", RFC 3261,	Schooler, "SIP: Session Initiation Protocol", RFC 3261,
	DOI 10.17487/RFC3261, June 2002,	DOI 10.17487/RFC3261, June 2002,

	<http://www.rfc-editor.org/info/rfc3261>.	<https://www.rfc-editor.org/info/rfc3261>.

	[RFC3264] Rosenberg, J. and H. Schulzrinne, "An Offer/Answer Model	[RFC3264] Rosenberg, J. and H. Schulzrinne, "An Offer/Answer Model
	with Session Description Protocol (SDP)", RFC 3264,	with Session Description Protocol (SDP)", RFC 3264,
	DOI 10.17487/RFC3264, June 2002,	DOI 10.17487/RFC3264, June 2002,

	<http://www.rfc-editor.org/info/rfc3264>.	<https://www.rfc-editor.org/info/rfc3264>.

	[RFC3323] Peterson, J., "A Privacy Mechanism for the Session	[RFC3323] Peterson, J., "A Privacy Mechanism for the Session
	Initiation Protocol (SIP)", RFC 3323,	Initiation Protocol (SIP)", RFC 3323,
	DOI 10.17487/RFC3323, November 2002,	DOI 10.17487/RFC3323, November 2002,

	<http://www.rfc-editor.org/info/rfc3323>.	<https://www.rfc-editor.org/info/rfc3323>.

	[RFC3711] Baugher, M., McGrew, D., Naslund, M., Carrara, E., and K.	[RFC3711] Baugher, M., McGrew, D., Naslund, M., Carrara, E., and K.
	Norrman, "The Secure Real-time Transport Protocol (SRTP)",	Norrman, "The Secure Real-time Transport Protocol (SRTP)",
	RFC 3711, DOI 10.17487/RFC3711, March 2004,	RFC 3711, DOI 10.17487/RFC3711, March 2004,

	<http://www.rfc-editor.org/info/rfc3711>.	<https://www.rfc-editor.org/info/rfc3711>.

	[RFC4568] Andreasen, F., Baugher, M., and D. Wing, "Session	[RFC4568] Andreasen, F., Baugher, M., and D. Wing, "Session
	Description Protocol (SDP) Security Descriptions for Media	Description Protocol (SDP) Security Descriptions for Media
	Streams", RFC 4568, DOI 10.17487/RFC4568, July 2006,	Streams", RFC 4568, DOI 10.17487/RFC4568, July 2006,

	<http://www.rfc-editor.org/info/rfc4568>.	<https://www.rfc-editor.org/info/rfc4568>.

	[RFC4916] Elwell, J., "Connected Identity in the Session Initiation	[RFC4916] Elwell, J., "Connected Identity in the Session Initiation
	Protocol (SIP)", RFC 4916, DOI 10.17487/RFC4916, June	Protocol (SIP)", RFC 4916, DOI 10.17487/RFC4916, June

	2007, <http://www.rfc-editor.org/info/rfc4916>.	2007, <https://www.rfc-editor.org/info/rfc4916>.

	[RFC5124] Ott, J. and E. Carrara, "Extended Secure RTP Profile for	[RFC5124] Ott, J. and E. Carrara, "Extended Secure RTP Profile for
	Real-time Transport Control Protocol (RTCP)-Based Feedback	Real-time Transport Control Protocol (RTCP)-Based Feedback
	(RTP/SAVPF)", RFC 5124, DOI 10.17487/RFC5124, February	(RTP/SAVPF)", RFC 5124, DOI 10.17487/RFC5124, February

	2008, <http://www.rfc-editor.org/info/rfc5124>.	2008, <https://www.rfc-editor.org/info/rfc5124>.

	[RFC5245] Rosenberg, J., "Interactive Connectivity Establishment	[RFC5245] Rosenberg, J., "Interactive Connectivity Establishment
	(ICE): A Protocol for Network Address Translator (NAT)	(ICE): A Protocol for Network Address Translator (NAT)
	Traversal for Offer/Answer Protocols", RFC 5245,	Traversal for Offer/Answer Protocols", RFC 5245,
	DOI 10.17487/RFC5245, April 2010,	DOI 10.17487/RFC5245, April 2010,

	<http://www.rfc-editor.org/info/rfc5245>.	<https://www.rfc-editor.org/info/rfc5245>.

	[RFC5763] Fischl, J., Tschofenig, H., and E. Rescorla, "Framework	[RFC5763] Fischl, J., Tschofenig, H., and E. Rescorla, "Framework
	for Establishing a Secure Real-time Transport Protocol	for Establishing a Secure Real-time Transport Protocol
	(SRTP) Security Context Using Datagram Transport Layer	(SRTP) Security Context Using Datagram Transport Layer
	Security (DTLS)", RFC 5763, DOI 10.17487/RFC5763, May	Security (DTLS)", RFC 5763, DOI 10.17487/RFC5763, May

	2010, <http://www.rfc-editor.org/info/rfc5763>.	2010, <https://www.rfc-editor.org/info/rfc5763>.

	[RFC6189] Zimmermann, P., Johnston, A., Ed., and J. Callas, "ZRTP:	[RFC6189] Zimmermann, P., Johnston, A., Ed., and J. Callas, "ZRTP:
	Media Path Key Agreement for Unicast Secure RTP",	Media Path Key Agreement for Unicast Secure RTP",
	RFC 6189, DOI 10.17487/RFC6189, April 2011,	RFC 6189, DOI 10.17487/RFC6189, April 2011,

	<http://www.rfc-editor.org/info/rfc6189>.	<https://www.rfc-editor.org/info/rfc6189>.

	[RFC6919] Barnes, R., Kent, S., and E. Rescorla, "Further Key Words	[RFC6919] Barnes, R., Kent, S., and E. Rescorla, "Further Key Words
	for Use in RFCs to Indicate Requirement Levels", RFC 6919,	for Use in RFCs to Indicate Requirement Levels", RFC 6919,
	DOI 10.17487/RFC6919, April 2013,	DOI 10.17487/RFC6919, April 2013,

	<http://www.rfc-editor.org/info/rfc6919>.	<https://www.rfc-editor.org/info/rfc6919>.

	[RFC6962] Laurie, B., Langley, A., and E. Kasper, "Certificate	[RFC6962] Laurie, B., Langley, A., and E. Kasper, "Certificate
	Transparency", RFC 6962, DOI 10.17487/RFC6962, June 2013,	Transparency", RFC 6962, DOI 10.17487/RFC6962, June 2013,

	<http://www.rfc-editor.org/info/rfc6962>.	<https://www.rfc-editor.org/info/rfc6962>.

	[RFC7245] Hutton, A., Ed., Portman, L., Ed., Jain, R., and K. Rehor,	[RFC7245] Hutton, A., Ed., Portman, L., Ed., Jain, R., and K. Rehor,
	"An Architecture for Media Recording Using the Session	"An Architecture for Media Recording Using the Session
	Initiation Protocol", RFC 7245, DOI 10.17487/RFC7245, May	Initiation Protocol", RFC 7245, DOI 10.17487/RFC7245, May

	2014, <http://www.rfc-editor.org/info/rfc7245>.	2014, <https://www.rfc-editor.org/info/rfc7245>.

	[RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an	[RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an
	Attack", BCP 188, RFC 7258, DOI 10.17487/RFC7258, May	Attack", BCP 188, RFC 7258, DOI 10.17487/RFC7258, May

	2014, <http://www.rfc-editor.org/info/rfc7258>.	2014, <https://www.rfc-editor.org/info/rfc7258>.

	[RFC7435] Dukhovni, V., "Opportunistic Security: Some Protection	[RFC7435] Dukhovni, V., "Opportunistic Security: Some Protection
	Most of the Time", RFC 7435, DOI 10.17487/RFC7435,	Most of the Time", RFC 7435, DOI 10.17487/RFC7435,

	December 2014, <http://www.rfc-editor.org/info/rfc7435>.	December 2014, <https://www.rfc-editor.org/info/rfc7435>.

	[RFC7675] Perumal, M., Wing, D., Ravindranath, R., Reddy, T., and M.	[RFC7675] Perumal, M., Wing, D., Ravindranath, R., Reddy, T., and M.
	Thomson, "Session Traversal Utilities for NAT (STUN) Usage	Thomson, "Session Traversal Utilities for NAT (STUN) Usage
	for Consent Freshness", RFC 7675, DOI 10.17487/RFC7675,	for Consent Freshness", RFC 7675, DOI 10.17487/RFC7675,

	October 2015, <http://www.rfc-editor.org/info/rfc7675>.	October 2015, <https://www.rfc-editor.org/info/rfc7675>.

	[RFC7879] Ravindranath, R., Reddy, T., Salgueiro, G., Pascual, V.,	[RFC7879] Ravindranath, R., Reddy, T., Salgueiro, G., Pascual, V.,
	and P. Ravindran, "DTLS-SRTP Handling in SIP Back-to-Back	and P. Ravindran, "DTLS-SRTP Handling in SIP Back-to-Back
	User Agents", RFC 7879, DOI 10.17487/RFC7879, May 2016,	User Agents", RFC 7879, DOI 10.17487/RFC7879, May 2016,

	<http://www.rfc-editor.org/info/rfc7879>.	<https://www.rfc-editor.org/info/rfc7879>.

	Authors' Addresses	Authors' Addresses

	Jon Peterson	Jon Peterson
	Neustar, Inc.	Neustar, Inc.
	1800 Sutter St Suite 570	1800 Sutter St Suite 570
	Concord, CA 94520	Concord, CA 94520
	US	US

	Email: jon.peterson@neustar.biz	Email: jon.peterson@neustar.biz

End of changes. 28 change blocks.
	30 lines changed or deleted	32 lines changed or added
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/