Subject: [dispatch] Media Plane Security draft-dawes-dispatch-mediasec-parameter-05

From: "Dawes, Peter, VF-Group" <[email-masked]>
Date: Thu, 1 Mar 2012 12:56:18 +0100

Hello All,

I would like to try to progress discussion of
http://www.ietf.org/id/draft-dawes-dispatch-mediasec-parameter-05.txt,
which proposes negotiation of security for the media plane by extending
an existing RFC (RFC 3329) that applies to the signalling plane. This
draft is also 3GPP related.

One way to provide security on the media plane of a session set up using
SIP is using DTLS-SRTP but this solution was not chosen by the 3GPP
security group for the reasons in clause 1.1.2.2 of
draft-dawes-dispatch-mediasec-parameter-05 and also because it was
considered very difficult to use in a terminal to access network edge
mode.

>From previous discussion on this e-mail list, the issues to resolve seem
to be 1) DTLS-SRTP already exists so should IETF describe an
alternative? 2) questions about using media security between a UA and a
media gateway at the access network edge versus end-to-end, i.e. 

|UA| ----encrypted media---- | Access Edge Media Gateway |
----unencrypted media---- |Access Edge Media Gateway| ----encrypted
media---- |UA|

The draft itself tries to answer these concerns (in the sub-clauses of
1.1 in particular) and previous comments on this topic can be found by
looking for Subject: Re: [dispatch] New I-D:
draft-dawes-dispatch-mediasec-parameter-01 on dates:

Jun 15 2010

May 20 - 27 2010

May 07 2010

April 27 - May 03 2010

As a first step, I would be interested to hear whether anyone still
objects in principle to progressing this draft for reasons 1) or 2)
above or any other reason?

Regards,

Peter

---

From: Adam Roach <[email-masked]>
Date: Wed, 07 Mar 2012 10:37:13 -0600

On 3/1/12 5:56 AM, Dawes, Peter, VF-Group wrote:
>
> One way to provide security on the media plane of a session set up 
> using SIP is using DTLS-SRTP but this solution was not chosen by the 
> 3GPP security group for the reasons in clause 1.1.2.2 of 
> draft-dawes-dispatch-mediasec-parameter-05
>

Which I'll quote below for the purposes of discussion:

>     Some networks are required by regulation to provide lawful intercept,
>     and no method compatible with DTLS-SRTP is available when a UA is
>     outside its own network (i.e., roaming).

Followed by a quote from RFC2804:

>     The IETF has decided not to consider requirements for wiretapping as
>     part of the process for creating and maintaining IETF standards.

And I'll leave it at that.

/a

---

From: "Dawes, Peter, VF-Group" <[email-masked]>
Date: Thu, 8 Mar 2012 17:49:55 +0100

Hello Adam,

Thanks very much for commenting on this topic. The primary purpose of
the draft is to enable set up of media security from a terminal to a
media security function in a "terminal to access edge" mode, so that the
media is at least protected from eavesdropping in the access network
e.g. a WiFi network. Although end-to-access-edge media security can make
it possible to perform lawful intercept in a core network, the terminal
can specify end-to-end protection as described at the end of 1.1.1. in
the draft.

(end of 1.1.1.)

End to access edge media protection described in this document is not

   a substitute for end-to-end media protection.  A user agent requests

   end-to-access-edge media protection by including a "a=3ge2ae" SDP

   attribute at session setup.  If this attribute is not included, then
end-to-end protection is expected by the user agent and protection

   MUST NOT fall back to end-to-access-edge protection.

So this media security functionality was not motivated by lawful
intercept but this was a consideration in the 3GPP discussions and
design behind the draft.

Regards,

Peter

From: Adam Roach [mailto:[email-masked]] 
Sent: 07 March 2012 16:37
To: Dawes, Peter, VF-Group
Cc: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [dispatch] Media Plane Security
draft-dawes-dispatch-mediasec-parameter-05

/a

---

From: Adam Roach <[email-masked]>
Date: Thu, 08 Mar 2012 12:39:20 -0600

On 3/8/12 10:49 AM, Dawes, Peter, VF-Group wrote:
> media security function in a "terminal to access edge" mode, so that 
> the media is at least protected from eavesdropping in the access 
> network e.g. a WiFi network. Although end-to-access-edge media 
> security can make it possible to perform lawful intercept in a core 
> network, the terminal can specify end-to-end protection as described 
> at the end of 1.1.1. in the draft.
>
> (end of 1.1.1.)
>
>    attribute at session setup.  If this attribute is not included, 
> then  end-to-end protection is expected by the user agent and protection
>

Be that as it may, by adding it to 1.1.2.2, you imply that is a 
constraining requirement on the solution. It cannot be. The fundamental 
outcome of the Raven process was that we don't constrain the IETF's 
protocols -- in any way -- to accommodate legal interception requirements.

What I'm saying is that you need to remove the quoted paragraph from the 
document. You also need to be willing to accept any changes that satisfy 
the other requirements in the document while potentially breaking 
intercept capabilities.

/a