draft-ietf-mmusic-securityprecondition-03.txt   draft-ietf-mmusic-securityprecondition-04.txt 
Internet Engineering Task Force Flemming Andreasen Internet Engineering Task Force Flemming Andreasen
MMUSIC Working Group Dan Wing MMUSIC Working Group Dan Wing
Internet-Draft Internet-Draft
Expires: April 2006 Cisco Systems Intended Status: Proposed Standard
Updates: RFC3312 (if accepted) October 19, 2006 Expires: January 2008 Cisco Systems
Updates: RFC3312 (if accepted) July 8, 2007
Security Preconditions for Security Preconditions for
Session Description Protocol (SDP) Media Streams Session Description Protocol (SDP) Media Streams
<draft-ietf-mmusic-securityprecondition-03.txt> <draft-ietf-mmusic-securityprecondition-04.txt>
Status of this memo Status of this memo
By submitting this Internet-Draft, each author represents that any By submitting this Internet-Draft, each author represents that any
applicable patent or other IPR claims of which he or she is aware applicable patent or other IPR claims of which he or she is aware
have been or will be disclosed, and any of which he or she becomes have been or will be disclosed, and any of which he or she becomes
aware will be disclosed, in accordance with Section 6 of BCP 79. aware will be disclosed, in accordance with Section 6 of BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as Internet- other groups may also distribute working documents as Internet-
Drafts. Drafts.
Internet-Drafts are draft documents valid for a maximum of six Internet-Drafts are draft documents valid for a maximum of six
months and may be updated, replaced, or obsoleted by other documents months and may be updated, replaced, or obsoleted by other documents
at any time. It is inappropriate to use Internet-Drafts as at any time. It is inappropriate to use Internet-Drafts as
reference material or cite them other than as "work in progress". reference material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/lid-abstracts.txt http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html http://www.ietf.org/shadow.html
This Internet-Draft will expire on April 19, 2006. This Internet-Draft will expire on January 8, 2008.
Copyright Notice Copyright Notice
Copyright (C) The Internet Society (2006). All Rights Reserved. Copyright (C) The IETF Trust (2007).
Abstract Abstract
This document defines a new security precondition for the Session This document defines a new security precondition for the Session
Description Protocol (SDP) precondition framework described in RFCs Description Protocol (SDP) precondition framework described in RFCs
3312 and 4032. A security precondition can be used to delay session 3312 and 4032. A security precondition can be used to delay session
establishment or modification until media stream security for a establishment or modification until media stream security for a
secure media stream has been negotiated successfully. secure media stream has been negotiated successfully.
1 Notational Conventions............................................2 1 Notational Conventions............................................2
2 Introduction......................................................2 2 Introduction......................................................2
3 Security Precondition Definition..................................3 3 Security Precondition Definition..................................3
4 Examples..........................................................6 4 Examples..........................................................6
4.1 SDP Security Descriptions Example.............................6 4.1 SDP Security Descriptions Example.............................6
4.2 Key Management Extension for SDP Example......................8 4.2 Key Management Extension for SDP Example......................8
5 Security Considerations..........................................11 5 Security Considerations..........................................11
6 IANA Considerations..............................................13 6 IANA Considerations..............................................13
7 Acknowledgements.................................................13 7 Acknowledgements.................................................13
8 Authors' Addresses...............................................13 8 Authors' Addresses...............................................13
9 Normative References.............................................13 9 Change Log.......................................................13
10 Informative References.........................................13 9.1 draft-ietf-mmusic-securityprecondition-04....................13
11 Intellectual Property Statement................................15 10 Normative References...........................................13
11 Informative References.........................................14
1 Notational Conventions 1 Notational Conventions
The key words "MUST", "MUST NOT", "REQUIRED", "MUST", "MUST NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119]. document are to be interpreted as described in [RFC2119].
2 Introduction 2 Introduction
The concept of a Session Description Protocol (SDP) [SDP] The concept of a Session Description Protocol (SDP) [RFC4566]
precondition is defined in [RFC3312] as updated by [RFC4032]. A precondition is defined in [RFC3312] as updated by [RFC4032]. A
precondition is a condition that has to be satisfied for a given precondition is a condition that has to be satisfied for a given
media stream in order for session establishment or modification to media stream in order for session establishment or modification to
proceed. When a (mandatory) precondition is not met, session proceed. When a (mandatory) precondition is not met, session
progress is delayed until the precondition is satisfied or the progress is delayed until the precondition is satisfied or the
session establishment fails. For example, RFC 3312 defines the session establishment fails. For example, RFC 3312 defines the
Quality of Service precondition, which is used to ensure Quality of Service precondition, which is used to ensure
availability of network resources prior to establishing (i.e. availability of network resources prior to establishing (i.e.
alerting) a call. alerting) a call.
skipping to change at page 3, line 42 skipping to change at page 3, line 43
The security precondition type is defined by the string "sec" and The security precondition type is defined by the string "sec" and
hence we modify the grammar found in RFC 3312 as follows: hence we modify the grammar found in RFC 3312 as follows:
precondition-type = "sec" | "qos" | token precondition-type = "sec" | "qos" | token
RFC 3312 defines support for two kinds of status types, namely RFC 3312 defines support for two kinds of status types, namely
segmented and end-to-end. The security precondition-type defined segmented and end-to-end. The security precondition-type defined
here MUST be used with the end-to-end status type; use of the here MUST be used with the end-to-end status type; use of the
segmented status type is undefined. segmented status type is undefined.
A security preconditions can use the strength-tag "mandatory", A security precondition can use the strength-tag "mandatory",
"optional" or "none". "optional" or "none".
When a security precondition with a strength-tag of "mandatory" is When a security precondition with a strength-tag of "mandatory" is
received in an offer, session establishment or modification MUST be received in an offer, session establishment or modification MUST be
delayed until the security precondition has been met, i.e. the delayed until the security precondition has been met, i.e. the
relevant cryptographic parameters (cipher, key, etc.) for a secure relevant cryptographic parameters (cipher, key, etc.) for a secure
media stream are known to have been negotiated in the direction(s) media stream are known to have been negotiated in the direction(s)
required. When a mandatory security precondition is offered, and required. When a mandatory security precondition is offered, and
the answerer cannot satisfy the security precondition, e.g. because the answerer cannot satisfy the security precondition, e.g. because
the offer was for a secure media stream, but it did not include the the offer was for a secure media stream, but it did not include the
skipping to change at page 6, line 16 skipping to change at page 6, line 16
offer/answer exchange and avoids forwarding the information to the offer/answer exchange and avoids forwarding the information to the
security layer for further processing. security layer for further processing.
Offers with security preconditions in re-INVITEs or UPDATEs follow Offers with security preconditions in re-INVITEs or UPDATEs follow
the rules given in Section 6 of RFC 3312, i.e.: the rules given in Section 6 of RFC 3312, i.e.:
"Both user agents SHOULD continue using the old session parameters "Both user agents SHOULD continue using the old session parameters
until all the mandatory preconditions are met. At that moment, until all the mandatory preconditions are met. At that moment,
the user agents can begin using the new session parameters." the user agents can begin using the new session parameters."
At that moment, we furthermore require that ser agents MUST start At that moment, we furthermore require that user agents MUST start
using the new session parameters for media packets being sent. The using the new session parameters for media packets being sent. The
user agents SHOULD be prepared to process media packets received user agents SHOULD be prepared to process media packets received
with either the old or the new session parameters for a short period with either the old or the new session parameters for a short period
of time to accommodate media packets in transit. Note that this may of time to accommodate media packets in transit. Note that this may
involve iterative security processing of the received media packets involve iterative security processing of the received media packets
during that period of time. Section 8 in [OFFANS] lists several during that period of time. Section 8 in [OFFANS] lists several
techniques to help alleviate the problem of determining when a techniques to help alleviate the problem of determining when a
received media packet was generated according to the old or new received media packet was generated according to the old or new
offer/answer exchange. offer/answer exchange.
skipping to change at page 12, line 24 skipping to change at page 12, line 24
message body were integrity protected, removal of the "precondition" message body were integrity protected, removal of the "precondition"
option tag could lead to clipping (when a security precondition was option tag could lead to clipping (when a security precondition was
otherwise to be used), whereas addition of the option tag could lead otherwise to be used), whereas addition of the option tag could lead
to session failure (if the other side does not support to session failure (if the other side does not support
preconditions). preconditions).
As specified in Section 3, security preconditions do not guarantee As specified in Section 3, security preconditions do not guarantee
that an established media stream will be secure. They merely that an established media stream will be secure. They merely
guarantee that the recipient of the media stream packets will be guarantee that the recipient of the media stream packets will be
able to perform any relevant decryption and integrity checking on able to perform any relevant decryption and integrity checking on
those media stream packets. If an offer includes a secure and a those media stream packets.
non-secure media stream as alternatives, this may lead to additional
security issues. It is important to understand how security
preconditions interact with those.
SDP and the offer/answer model currently do not define how such Current SDP [RFC4566] and associated offer/answer procedures
alternatives could be negotiated, however there is work in [RFC3264] allows only a single type of transport protocol to be
progress to address that (see e.g. [SDPCN]). Negotiating secure negotiated for a given media stream in an offer/answer exchange.
and non-secure media streams as alternatives however introduces Negotiation of alternative transport protocols, e.g. plain and
several security issues and hence SHOULD NOT be done until a secure RTP, is currently not defined. Thus, if the transport
complete specification for doing so has been documented in detail protocol offered (e.g. secure RTP) is not supported, the offered
and reviewed properly. Below, we provide general security media stream will simply be rejected. There is however work in
considerations for security preconditions that may aid in the progress to address that. For example, the SDP Capability
design and review of such mechanisms. Negotiation framework [SDPCN] defines a method for negotiating use
of a secure or a non-secure transport protocol by use of SDP and the
offer/answer model with various extensions.
Note that a basic premise of negotiating secure and non-secure media Such a mechanism introduces a number of security considerations in
streams as alternatives is that the offerer's security policy allows general, however use of SDP Security Preconditions with such a
for non-secure media. If the offer were to include secure and non- mechanism introduces the following security precondition specific
security considerations:
A basic premise of negotiating secure and non-secure media streams
as alternatives is that the offerer's security policy allows for
non-secure media. If the offer were to include secure and non-
secure media streams as alternative offers, and media for either secure media streams as alternative offers, and media for either
alternative may be received prior to the answer, then the offerer alternative may be received prior to the answer, then the offerer
may not know if the answerer accepted the secure alternative. An may not know if the answerer accepted the secure alternative. An
active attacker thus may be able to inject malicious media stream active attacker thus may be able to inject malicious media stream
packets until the answer (indicating the chosen secure alternative) packets until the answer (indicating the chosen secure alternative)
is received. Use of security preconditions (even with a mandatory is received. From a security point of view, it is important to note
strength-tag) would not address this vulnerability since security that use of security preconditions (even with a mandatory strength-
preconditions would apply only to the secure media stream tag) would not address this vulnerability since security
alternatives. preconditions would effectively apply only to the secure media
stream alternatives. If the non-secure media stream alternative was
selected by the answerer, the security precondition would be
satisfied by definition, the session could progress and (non-secure)
media could be received prior to the answer being received.
6 IANA Considerations 6 IANA Considerations
IANA is hereby requested to register a RFC 3312 precondition type IANA is hereby requested to register a RFC 3312 precondition type
called "sec" with the name "Security precondition". The reference called "sec" with the name "Security precondition". The reference
for this precondition type is the current document. for this precondition type is the current document.
7 Acknowledgements 7 Acknowledgements
The security precondition was defined in earlier draft versions of The security precondition was defined in earlier draft versions of
skipping to change at page 13, line 34 skipping to change at page 13, line 37
499 Thornall Street, 8th Floor 499 Thornall Street, 8th Floor
Edison, New Jersey 08837 USA Edison, New Jersey 08837 USA
EMail: fandreas@cisco.com EMail: fandreas@cisco.com
Dan Wing Dan Wing
Cisco Systems, Inc. Cisco Systems, Inc.
170 West Tasman Drive 170 West Tasman Drive
San Jose, CA 95134 USA San Jose, CA 95134 USA
EMail: dwing@cisco.com EMail: dwing@cisco.com
9 Normative References 9 Change Log
9.1 draft-ietf-mmusic-securityprecondition-04
o Updated security considerations to better address security
precondition interaction with capability negotiation of secure
and non-secure media stream alternatives.
10 Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997. Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3312] G. Camarillo, W. Marshall, J. Rosenberg, "Integration of [RFC3312] G. Camarillo, W. Marshall, J. Rosenberg, "Integration of
Resource Management and Session Initiation Protocol (SIP)", RFC Resource Management and Session Initiation Protocol
3312, October 2002. (SIP)", RFC 3312, October 2002.
[RFC4032] G. Camarillo and P. Kyzivat, "Update to the Session [RFC4032] G. Camarillo and P. Kyzivat, "Update to the Session
Initiation Protocol (SIP) Preconditions Framework", RFC 4032, March Initiation Protocol (SIP) Preconditions Framework", RFC
2005. 4032, March 2005.
[RFC2327] M. Handley and V. Jacobson, "SDP: Session Description [SIP] J. Rosenberg, H. Schulzrinne, G. Camarillo, A. Johnston,
Protocol", RFC 2327, April 1998. J. Peterson, R. Sparks, M. Handley, E. Schooler, "SIP:
Session Initiation Protocol", RFC 3261, June 2002.
[SIP] J. Rosenberg, H. Schulzrinne, G. Camarillo, A. Johnston, J. [RFC4566] Handley, M., Jacobson, V., and C. Perkins, "SDP: Session
Peterson, R. Sparks, M. Handley, E. Schooler, "SIP: Session Description Protocol", RFC 4566, July 2006.
Initiation Protocol", RFC 3261, June 2002.
[RFC3264] Rosenberg, J., and H. Schulzrinne, "An Offer/Answer Model
with Session Description Protocol (SDP)", RFC 3264, June
2002.
11 Informative References
10 Informative References
[SDESC] F. Andreasen, M. Baugher, and D. Wing, "Session [SDESC] F. Andreasen, M. Baugher, and D. Wing, "Session
Description Protocol (SDP) Security Descriptions for Media Streams", Description Protocol (SDP) Security Descriptions for Media
RFC 4568, July 2006. Streams", RFC 4568, July 2006.
[OFFANS] J. Rosenberg, and H. Schulzrinne, "An Offer/Answer Model [OFFANS] J. Rosenberg, and H. Schulzrinne, "An Offer/Answer Model
with the Session Description Protocol (SDP)", RFC 3264, June 2002. with the Session Description Protocol (SDP)", RFC 3264,
June 2002.
[RFC3551] H. Schulzrinne, and S. Casner "RTP Profile for Audio and [RFC3551] H. Schulzrinne, and S. Casner "RTP Profile for Audio and
Video Conferences with Minimal Control", RFC 3550, July 2003. Video Conferences with Minimal Control", RFC 3550, July
2003.
[SRTP] M. Baugher, D. McGrew, M. Naslund, E. Carrara, K. [SRTP] M. Baugher, D. McGrew, M. Naslund, E. Carrara, K. Norrman,
Norrman, "The Secure Real-time Transport Protocol", RFC 3711, March "The Secure Real-time Transport Protocol", RFC 3711, March
2004. 2004.
[ICE] J. Rosenberg, "Interactive Connectivity Establishment [ICE] J. Rosenberg, "Interactive Connectivity Establishment
(ICE): A Methodology for Network Address Translator (NAT) Traversal (ICE): A Methodology for Network Address Translator (NAT)
for Multimedia Session Establishment Protocols", IETF, work-in- Traversal for Multimedia Session Establishment Protocols",
progress. IETF, work-in-progress.
[KMGMT] J. Arkko, E. Carrara, F. Lindholm, M. Naslund, and K. [KMGMT] J. Arkko, E. Carrara, F. Lindholm, M. Naslund, and K.
Norrman, "Key Management Extensions for Session Description Protocol Norrman, "Key Management Extensions for Session
(SDP) and Real Time Streaming Protocol (RTSP)", IETF, work-in- Description Protocol (SDP) and Real Time Streaming
progress. Protocol (RTSP)", IETF, work-in-progress.
[MIKEY] J. Arkko, E. Carrara, F. Lindholm, M. Naslund, and K. [MIKEY] J. Arkko, E. Carrara, F. Lindholm, M. Naslund, and K.
Norrman, "MIKEY: Multimedia Internet KEYing", RFC 3830, August 2004. Norrman, "MIKEY: Multimedia Internet KEYing", RFC 3830,
August 2004.
[RFC3262] Rosenberg, J. and H. Schulzrinne, "Reliability of [RFC3262] Rosenberg, J. and H. Schulzrinne, "Reliability of
Provisional Responses in Session Initiation Protocol (SIP)", RFC Provisional Responses in Session Initiation Protocol
3262, June 2002. (SIP)", RFC 3262, June 2002.
[RFC3311] J. Rosenberg, "The Session Initiation Protocol (SIP) [RFC3311] J. Rosenberg, "The Session Initiation Protocol (SIP)
UPDATE Method," RFC 3311, September 2002. UPDATE Method," RFC 3311, September 2002.
[HERFP] R. Mahy, "A Solution to the Heterogeneous Error Response [HERFP] R. Mahy, "A Solution to the Heterogeneous Error Response
Forking Problem (HERFP) in the Session Initiation Problem (SIP)", Forking Problem (HERFP) in the Session Initiation Problem
Work in Progress, March 2006. (SIP)", Work in Progress, March 2006.
[SDPCN] F. Andreasen, "SDP Capability Negotiation", Work in [SDPCN] F. Andreasen, "SDP Capability Negotiation", Work in
Progress, June 2006. Progress, July 2007.
11 Intellectual Property Statement Intellectual Property Statement
The IETF takes no position regarding the validity or scope of any The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed Intellectual Property Rights or other rights that might be claimed
to pertain to the implementation or use of the technology described to pertain to the implementation or use of the technology
in this document or the extent to which any license under such described in this document or the extent to which any license
rights might or might not be available; nor does it represent that under such rights might or might not be available; nor does it
it has made any independent effort to identify any such rights. represent that it has made any independent effort to identify any
Information on the IETF's procedures with respect to rights in IETF such rights. Information on the procedures with respect to rights
Documents can be found in BCP 78 and BCP 79. in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use attempt made to obtain a general license or permission for the use
of such proprietary rights by implementers or users of this of such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository specification can be obtained from the IETF on-line IPR repository
at http://www.ietf.org/ipr. at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any The IETF invites any interested party to bring to its attention
copyrights, patents or patent applications, or other proprietary any copyrights, patents or patent applications, or other
rights that may cover technology that may be required to implement proprietary rights that may cover technology that may be required
this standard. Please address the information to the IETF at to implement this standard. Please address the information to the
ietf-ipr@ietf.org. IETF at ietf-ipr@ietf.org.
Disclaimer of Validity Full Copyright Statement
This document and the information contained herein are provided on Copyright (C) The IETF Trust (2007).
an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE
REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE
INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Copyright Statement This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
Copyright (C) The Internet Society (2006). This document is subject This document and the information contained herein are provided on
to the rights, licenses and restrictions contained in BCP 78, and an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE
except as set forth therein, the authors retain all their rights. REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE
IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL
WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY
WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE
ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS
FOR A PARTICULAR PURPOSE.
Acknowledgment Acknowledgment
Funding for the RFC Editor function is currently provided by the Funding for the RFC Editor function is currently provided by the
Internet Society. Internet Society.
 End of changes. 38 change blocks. 
87 lines changed or deleted 114 lines changed or added

This html diff was produced by rfcdiff 1.33. The latest version is available from http://tools.ietf.org/tools/rfcdiff/