Minutes IETF97: avtcore
minutes-97-avtcore-00

Meeting Minutes Audio/Video Transport Core Maintenance (avtcore) WG
Title Minutes IETF97: avtcore
State Active
Other versions plain text
Last updated 2016-12-09

Meeting Minutes
minutes-97-avtcore

   AVTCORE WG Minutes IETF 97 

Minutes: Magnus Westerlund

0:00 	AVTCore WG Status Update	Chairs 

Eric Rescorla commented on process related to the ARIA. From his 
perspective ARIA is a vanity algorithm and that is why no one bothers to 
review it. IETF should stop wasting time on such algorithm. Roni Even 
responded that the issue is the IANA registration rules. EKR suggested 
that due that the namespace is rather large, in DTLS it is 2 octets. 
There is no real shortage. Thus registrations could be liberal, and then 
there is a column which says “Recommend” and which only well 
reviewed algorithms would get. And it should be the people proposing the 
new algorithm that should update the IANA registration rules. Magnus 
Westerlund responded that considering how long this document has been 
with the IETF to meet our requirements, including the need to split it, 
it appears wrong to force these authors to perform such a task. However, 
Magnus did support requiring such changes for any future registration 
request. Ben Campbell, was positive to consider it, and would discuss it 
with his fellow ART ADs. 

Multipath RTP needs reviews to make progress. WG chairs will solicit 
reviews. 

Multiplexing guidelines (draft-ietf-avtcore-multiplex-guidelines) 
hasn’t been update yet. The task is with Magnus Westerlund. 

The WG milestones where reviewed. 

0:05	A General Mechanism for RTP Header Extensions	Roni Even 
	    draft-ietf-avtcore-rfc5285-bis-04

Cullen Jennings asked what the updated text requirements on what 
happens if RTP header extensions are stripped. Colin Perkins clarified 
that the in the specification is to go from all RTP header extensions 
must be possible to strip, without affecting interoperability, to make 
it clear that stripping of an RTP header extensions must not effect the 
RTP layer processing, thus allowing header extensions like the MID that 
will affect the higher layer application. Cullen commented that we 
should not write rules that will be ignored, as that only results in 
that our specifications are ignored in other aspects. We should require 
that RTP header extensions, are not stripped. Colin responded that there 
are certain systems that must be able to strip them, for example mixers. 
However, they can also regenerate the necessary ones for the produced 
stream. But, it is for an application context to define how this should 
be handled, for example RTCWeb could defined that it is not allowed to 
remove header extensions, unless equivalent are generated on the next 
leg of the session. Jonathan Lennox, commented, that what this is 
intended to cover cases like process fields with small endian rather big 
endian. Such changes are for RTP profiles. 

Roni concluded that the document is ready. Magnus Westerlund as chair 
commented that this will go to WG LC soon. 


0:20 	Unknown Key Share Attacks on uses of DTLS	Martin Thomson 
     	draft-thomson-avtcore-sdp-uks

 Martin explained the Unknown Key Share attack. 

Magnus Westerlund challenged if you really need two concurrent sessions 
to perform this attack. Martin commented that they done extensive 
analysis. Eric Rescorla clarified that what is distinguishing here is 
that the attacked party believes it is talking to the attacker, while 
talking to someone else, while that other party knows it talks to the 
attacked. With one session one ends up in a situation that both the 
peers think they talk to the attacker. Magnus Westerlund commented that 
if you have two signaling system where the attack impersonates the other 
peer on the signaling level the attacker can cause this trust case which 
this attack discusses. EKR requested that if you believe you have a case 
where this can be used with a single connection or makes this more 
useful as an attack, please sketch it up and discuss it with the draft 
authors. 

Cullen commented that the most interesting case where this can be used, 
is when you have central media service. However, the end result is that 
you end up thinking you talk to attacker, while talking to WebEx system, 
still not an interesting attack. 

Jonathan Lennox asked why this is not in MMUSIC WG, the issues appears 
to be connected to the signaling. Martin commented that is because of 
the solution. Eric Rescorla added that while regular TLS is resilient to 
UKS attack, because the identities asserted are carried as part of the 
handshakes. This is not the case in DTLS-SRTP as the certificate 
fingerprint or identity assertions are carried in the signaling layer. 
What is the next step for this? Cullen Jennings proposed that the next 
step is an extension in MMUSIC SDP fingerprint attribute. Martin 
commented that the current solution uses existing SDP information and 
includes that in TLS. Cullen commented that this is not currently 
alarming, but someone always figure out a way to exploit things, thus it 
should be addressed. This appears to require both SDP and TLS changes. 
Jonathan commented that this appears to belong in MMUSIC rather than in 
AVTCORE as it an extension to RFC 4572. Magnus Westerlund commented that 
the security attack may be an update towards the DTLS-SRTP 
specification. 

Jonathan Lennox asked if there is any solution to the splicing attack. 
Martin responded that upper layer identity solutions are probably what 
you need. 

Conclusion, this topic needs to be dispatched to the appropriate WG(s). 


0:40 	AVTCORE and AVTEXT WG merger discuss	Chairs

Magnus Westerlund presented the background and the proposal for going 
forward by merging AVTCORE and AVTEXT. 

Ben Campbell commented that a reason for merging is to ensure sufficient 
activity level so participants pay attention and don’t miss things 
happening. 

Colin Perkins supports merging the WGs, should consider XRBLOCK and 
Payload to also be considered to be merged. 

Harald Alvestrand, calling review panels WG is a bad idea. However, one 
review panel is better than two. 

Cullen Jennings, make sense to merge these two. With the less specific 
AD handling of WGs, another reason for the split has been removed. 

Bernard Aboba supports merging including Colin suggestions to include 
XRBlock. 

Zahed Sarker the working groups should be merged. The WG chairs load is 
clearly low enough. 

Ben Campbell commented that XRBLOCK are future potentials. The XRBLOCK 
WG has requested to stay open a bit longer, and Payload has a bit 
different dynamics. Even if we don’t merge them in at this point, it 
can easily be done in the future. 

Mo Zanathy do merge AVTEXT and AVTCORE, also merging XRBLOCK would be 
good. 

Jonathan Lennox keeping payload out would probably be good, but 
including XRBLOCK is not a bad idea. 

Magnus Westerlund thanked for the input and concluded that the next 
steps will be discussed with chairs and AD and the charter proposal 
circulated.