Subject: [rtcweb] security-arch: RTP and RTCP Key Management (mux and non-mux)

From: Bernard Aboba <[email-masked]>
Date: Mon, 21 Jul 2014 23:33:44 -0400

I have had some questions about DTLS/SRTP key derivation in the multiplexed
and non-multiplexed cases.  The questions arise from the following sentence
in RFC 5764 Section 3:

   There MUST be a separate DTLS-SRTP session for each
   distinct pair of source and destination ports used by a media session
   (though the sessions can share a single DTLS session and hence
   amortize the initial public key handshake!).

[BA] My question is whether WebRTC permits DTLS-SRTP sessions to share a
single DTLS session or not.

The description in security-arch Section 4.3 seems to indicate that where
symmetric RTP and RTCP is not multiplexed it is expected to have two
separate DTLS sessions, and for RTP/RTCP multiplexed there will be a single
DTLS session:

   Specifically, Alice and Bob perform a DTLS
   handshake on every channel which has been established by ICE.  The
   total number of channels depends on the amount of muxing; in the most
   likely case we are using both RTP/RTCP mux and muxing multiple media
   streams on the same channel, in which case there is only one DTLS
   handshake.  Once the DTLS handshake has completed, the keys are
   exported [RFC5705 <http://tools.ietf.org/html/rfc5705>] and used to key
SRTP for the media channels.

[BA] However, I didn't see any normative language indicating that this is
the only permitted configuration (although my understanding is that every
existing implementations operates this way).

---

From: Martin Thomson <[email-masked]>
Date: Tue, 22 Jul 2014 08:59:42 -0700

> single DTLS session or not.

Yeah, keying multiple SRTP sessions from a single DTLS session could
(would) lead to key reuse if the different sessions use the same SSRC
values.  That's why 5764 says what it says.

Writing this down makes sense, though we need only lean on what 5764 says.

---

From: Bernard Aboba <[email-masked]>
Date: Tue, 22 Jul 2014 13:18:35 -0400

Martin said:

"Yeah, keying multiple SRTP sessions from a single DTLS session could
(would) lead to key reuse if the different sessions use the same SSRC
values.  That's why 5764 says what it says."

[BA] Yes - but the question was about deriving SRTCP and SRTP keys from a
single DTLS session when RTP and RTCP are not multiplexed.   That wouldn't
result in key reuse.