Subject: [saag] vbr srtp question

From: Stephen Farrell <[email-masked]>
Date: Thu, 17 Nov 2011 09:09:38 +0000

Hi,

We had a presentation [1] at the saag session today
about some recommendations [2] for safely using
variable bit rate encoding and SRTP.

Robert correctly pointed out that I didn't state
the specific concern that I had with the document,
and for which I'm looking for a bit of help.

The issue is that a recent paper [3] might (or
might not) imply that the recommendations in the
draft should be strengthened or changed. My problem
is that I don't really know whether or not some
change is actually needed (since I've not had time
and probably just don't know enough;-)

If someone can offer specific help on this aspect
in the next week or two please let me know.

Thanks,
Stephen.

[1] http://www.ietf.org/proceedings/82/slides/saag-1.pdf

[2] https://datatracker.ietf.org/doc/draft-ietf-avtcore-srtp-vbr-audio/

[3] White, A.M.; Matthews, A.R.; Snow, K.Z.; Monrose, F.; ,
    "Phonotactic Reconstruction of Encrypted VoIP Conversations:
    Hookt on Fon-iks," Security and Privacy (SP), 2011 IEEE Symposium
    on , vol., no., pp.3-18, 22-25 May 2011
    doi: 10.1109/SP.2011.34
    URL:
http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=5958018&isnumber=5958008

---

From: Colin Perkins <[email-masked]>
Date: Thu, 17 Nov 2011 18:11:48 +0800

Stephen,

I hadn't previously seen this paper. From a quick look, it doesn't change our recommendations for how to mitigate the attack, but we may be wise to strengthen the guidelines on when such mitigation is needed.

I'll read the paper more carefully, and propose a revised draft.

Colin

-- 
Colin Perkins
http://csperkins.org/