Best Practices for Securing RTP Media Signaled with SIP
draft-ietf-sipbrandy-rtpsec-06

Document Type Active Internet-Draft (sipbrandy WG)
Last updated 2018-10-30 (latest revision 2018-10-15)
Replaces draft-peterson-sipbrandy-rtpsec
Stream IETF
Intended RFC status Best Current Practice
Formats plain text xml pdf html bibtex
Stream WG state Submitted to IESG for Publication
Document shepherd Gonzalo Camarillo
Shepherd write-up Show (last changed 2018-10-30)
IESG IESG state AD Evaluation
Consensus Boilerplate Yes
Telechat date
Responsible AD Ben Campbell
Send notices to Gonzalo Camarillo <gonzalo.camarillo@ericsson.com>
Network Working Group                                        J. Peterson
Internet-Draft                                                   Neustar
Intended status: Best Current Practice                         R. Barnes
Expires: April 18, 2019                                          Mozilla
                                                              R. Housley
                                                          Vigil Security
                                                        October 15, 2018

        Best Practices for Securing RTP Media Signaled with SIP
                     draft-ietf-sipbrandy-rtpsec-06

Abstract

   Although the Session Initiation Protocol (SIP) includes a suite of
   security services that has been expanded by numerous specifications
   over the years, there is no single place that explains how to use SIP
   to establish confidential media sessions.  Additionally, existing
   mechanisms have some feature gaps that need to be identified and
   resolved in order for them to address the pervasive monitoring threat
   model.  This specification describes best practices for negotiating
   confidential media with SIP, including both comprehensive protection
   solutions which bind the media to SIP-layer identities as well as
   opportunistic security solutions.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on April 18, 2019.

Copyright Notice

   Copyright (c) 2018 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

Peterson, et al.         Expires April 18, 2019                 [Page 1]
Internet-Draft                RTP Security                  October 2018

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   3
   3.  Security at the SIP and SDP layer . . . . . . . . . . . . . .   3
     3.1.  Comprehensive Protection  . . . . . . . . . . . . . . . .   3
     3.2.  Opportunistic Security  . . . . . . . . . . . . . . . . .   4
   4.  STIR Profile for Endpoint Authentication and Verification
       Services  . . . . . . . . . . . . . . . . . . . . . . . . . .   4
     4.1.  Credentials . . . . . . . . . . . . . . . . . . . . . . .   5
     4.2.  Anonymous Communications  . . . . . . . . . . . . . . . .   6
     4.3.  Connected Identity Usage  . . . . . . . . . . . . . . . .   7
     4.4.  Authorization Decisions . . . . . . . . . . . . . . . . .   8
   5.  Media Security Protocols  . . . . . . . . . . . . . . . . . .   9
   6.  Relayed Media and Conferencing  . . . . . . . . . . . . . . .   9
   7.  ICE and Connected Identity  . . . . . . . . . . . . . . . . .  10
   8.  Best Current Practices  . . . . . . . . . . . . . . . . . . .  10
   9.  Acknowledgments . . . . . . . . . . . . . . . . . . . . . . .  11
   10. IANA Considerations . . . . . . . . . . . . . . . . . . . . .  11
   11. Security Considerations . . . . . . . . . . . . . . . . . . .  11
   12. References  . . . . . . . . . . . . . . . . . . . . . . . . .  11
     12.1.  Normative References . . . . . . . . . . . . . . . . . .  11
     12.2.  Informative References . . . . . . . . . . . . . . . . .  13
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  14

1.  Introduction

   The Session Initiation Protocol (SIP) [RFC3261] includes a suite of
   security services, ranging from Digest authentication for
   authenticating entities with a shared secret, to TLS for transport
   security, to S/MIME (optionally) for body security.  SIP is
   frequently used to establish media sessions, in particular audio or
   audiovisual sessions, which have their own security mechanisms
   available, such as Secure RTP [RFC3711].  However, the practices
   needed to bind security at the media layer to security at the SIP
Show full document text