One document matched: draft-ietf-sip-media-security-requirements-00.xml


<?xml version="1.0" encoding="US-ASCII"?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd" [
<!ENTITY RFC2119 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2119.xml">
<!ENTITY RFC3261 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3261.xml">
<!ENTITY RFC3262 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3262.xml">
<!ENTITY RFC3264 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3264.xml">
<!ENTITY RFC3711 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3711.xml">
<!ENTITY I-D.ietf-mmusic-securityprecondition SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-mmusic-securityprecondition.xml">
<!ENTITY RFC3550 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3550.xml">
<!ENTITY I-D.ietf-mmusic-ice SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-mmusic-ice.xml">
<!ENTITY I-D.peterson-sipping-retarget SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.peterson-sipping-retarget.xml">
<!ENTITY RFC4474 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4474.xml">
<!ENTITY I-D.barnes-sip-em-ps-req-sol SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.barnes-sip-em-ps-req-sol.xml">
<!ENTITY I-D.wing-sipping-srtp-key SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.wing-sipping-srtp-key.xml">
<!ENTITY rfc4568 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4568.xml">
<!ENTITY rfc4650 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4650.xml">
<!ENTITY I-D.ietf-msec-mikey-ecc SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-msec-mikey-ecc.xml">
<!ENTITY rfc4738 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4738.xml">
<!ENTITY I-D.ietf-sip-certs SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-sip-certs.xml">
<!ENTITY I-D.mahy-sipping-herfp-fix SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.mahy-sipping-herfp-fix.xml">
<!ENTITY rfc3830 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3830.xml">
<!ENTITY rfc4492 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4492.xml">
<!ENTITY rfc3388 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3388.xml">
<!ENTITY rfc4346 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4346.xml">
<!ENTITY I-D.fischl-sipping-media-dtls SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.fischl-sipping-media-dtls.xml">
<!ENTITY I-D.ietf-msec-mikey-applicability SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-msec-mikey-applicability.xml">
<!ENTITY I-D.zimmermann-avt-zrtp SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.zimmermann-avt-zrtp.xml">
<!ENTITY I-D.baugher-mmusic-sdp-dh SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.baugher-mmusic-sdp-dh.xml">
<!ENTITY I-D.mcgrew-srtp-ekt SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.mcgrew-srtp-ekt.xml">
<!ENTITY rfc4771 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4771.xml">
<!ENTITY rfc4916 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4916.xml">
<!ENTITY I-D.jennings-sipping-multipart SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.jennings-sipping-multipart.xml">
<!ENTITY I-D.mcgrew-tls-srtp SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.mcgrew-tls-srtp.xml">
<!ENTITY I-D.dondeti-msec-rtpsec-mikeyv2 SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.dondeti-msec-rtpsec-mikeyv2.xml">
<!ENTITY I-D.ietf-mmusic-sdp-capability-negotiation SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-mmusic-sdp-capability-negotiation.xml">
]>
<?rfc toc="yes" ?>
<?rfc symrefs="yes" ?>
<?rfc sortrefs="yes"?>
<?rfc iprnotified="no" ?>
<?rfc strict="yes" ?>
<?rfc compact="yes" ?>
<?rfc subcompact="no" ?>
<rfc category="info" docName="draft-ietf-sip-media-security-requirements-00.txt"
     ipr="full3978">
  <front>
    <title abbrev="Media Security Requirements and Analysis">Requirements and Analysis of Media
    Security Key Management Protocols</title>

    <author fullname="Dan Wing" initials="D." surname="Wing">
      <organization abbrev="Cisco">Cisco Systems, Inc.</organization>

      <address>
        <postal>
          <street>170 West Tasman Drive</street>

          <city>San Jose</city>

          <region>CA</region>

          <code>95134</code>

          <country>USA</country>
        </postal>

        <email>dwing@cisco.com</email>
      </address>
    </author>

    <author fullname="Steffen Fries" initials="S." surname="Fries">
      <organization>Siemens AG</organization>

      <address>
        <postal>
          <street>Otto-Hahn-Ring 6</street>

          <city>Munich</city>

          <region>Bavaria</region>

          <code>81739</code>

          <country>Germany</country>
        </postal>

        <email>steffen.fries@siemens.com</email>
      </address>
    </author>

    <author fullname="Hannes Tschofenig" initials="H" surname="Tschofenig">
      <organization>Nokia Siemens Networks</organization>

      <address>
        <postal>
          <street>Otto-Hahn-Ring 6</street>

          <city>Munich</city>

          <region>Bavaria</region>

          <code>81739</code>

          <country>Germany</country>
        </postal>

        <email>Hannes.Tschofenig@nsn.com</email>

        <uri>http://www.tschofenig.com</uri>
      </address>
    </author>

    <author fullname="Francois Audet" initials="F." surname="Audet">
      <organization>Nortel</organization>

      <address>
        <postal>
          <street>4655 Great America Parkway</street>

          <city>Santa Clara</city>

          <region>CA</region>

          <code>95054</code>

          <country>USA</country>
        </postal>

        <email>audet@nortel.com</email>
      </address>
    </author>

    <date year="2007" />

    <area>RAI</area>

    <workgroup>SIP</workgroup>
    
    <keyword>I-D</keyword>

    <keyword>Internet-Draft</keyword>

    <abstract>
      <t>A number of proposals have been published to address the need of
      securing media traffic. A summary of the proposals available at that
      time is available in the appendix of this document. Different
      assumptions, requirements, and usage environments justify every one of
      them. This document aims to summarize the discussed media security
      requirements. A comparison of the requirements against the individual
        proposals is provided.</t>
    </abstract>
  </front>

  <middle>
    <section title="Introduction">
      <t>The work on media security started a long time ago where the
      capability of the Session Initiation Protocol (SIP) was still at its
      infancy. With the increased SIP deployment and the availability of new
      SIP extensions and related protocols the need for end-to-end security
      was re-evaluated. The procedure of re-evaluating prior protocol work and
      design decisions is not an uncommon strategy and, to some extend,
      considered necessary protocol work to ensure that the developed
      protocols indeed meet the previously envisioned needs for the users in
      the Internet.</t>
      
      <t>This document aims to summarize the discussed media security requirements, i.e.,
        requirements for mechanisms that negotiate keys and parameters for SRTP. The organization of
        this document is as follows: <xref target="terminology"/> introduces terminology, <xref
          target="scenarios"/> provides an overview about possible call scenarios, <xref
            target="requirements"/> lists requirements for media security, <xref target="clustering"/>
        will provide a clustering of requirements to certain deployment environments to adress the
        problem that there might not be a single solution with universal applicability. The main
        part of the document concludes with the security considerations <xref target="security"/>,
        IANA considerations <xref target="iana"/> and an acknowledgement section in <xref
          target="acks"/>. The appendix contains an overview of the <xref target="comparison"/>
        lists the available solution proposals and compares them to the requirements. <xref
          target="ofs"/> lists non-goals for this document.</t>
      
    </section>

    <section anchor="terminology" title="Terminology">
      <t>The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
      "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
      document are to be interpreted as described in <xref
      target="RFC2119"></xref>, with the important qualification that, unless
      otherwise stated, these terms apply to the design of the media security
      key management protocol, not its implementation or application.</t>

      <t>Additionally, the following items are used in this document:</t>

      <t><list style="hanging">
          <t hangText="AOR (Address-of-Record): ">A SIP or SIPS URI that
          points to a domain with a location service that can map the URI to
          another URI where the user might be available. Typically, the
          location service is populated through registrations. An AOR is
          frequently thought of as the "public address" of the user.</t>

          <t hangText="SSRC: ">The 32-bit value that defines the
          synchronization source, used in RTP. These are generally unique, but
          collisions can occur.</t>

          <t hangText="two-time pad: ">The use of the same key and the same
          key index to encrypt different data. For SRTP, a two-time pad occurs
          if two senders are using the same key and the same RTP SSRC
          value.</t>

          <t hangText="PKI">Public Key Infrastructure. Throughout this paper,
          the term PKI refers to a global PKI.</t>
        </list></t>
    </section>

    <section anchor="scenarios" title="Call Scenarios">
      <t>The following subsections describe call scenarios with relevance for
      media security. These call scenarios pose the most challenge to the key
      management for media data in cooperation with SIP signaling.</t>

      <!-- ====================================================================== -->

      <section anchor="clipping"
               title="Clipping Media Before Signaling Answer">
        <t>Per the SDP Offer/Answer Model <xref target="RFC3264"></xref>,</t>

        <t><list>
            <t>"Once the offerer has sent the offer, it MUST be prepared to
            receive media for any recvonly streams described by that offer. It
            MUST be prepared to send and receive media for any sendrecv
            streams in the offer, and send media for any sendonly streams in
            the offer (of course, it cannot actually send until the peer
            provides an answer with the needed address and port
            information)."</t>
          </list></t>

        <t>To meet this requirement with SRTP, the offerer needs to know the
        SRTP key for arriving media. If encrypted SRTP media arrives before
        the associated SRTP key, the offerer cannot play the media -- causing
        clipping.</t>

        <t>For key exchange mechanisms that send the answerer's key in SDP, a
        SIP provisional response <xref target="RFC3261"></xref>, such as 183
        (session progress), is useful. However, the 183 messages are not
        reliable unless both the calling and called end point support PRACK
        <xref target="RFC3262"></xref>, use TCP across all SIP proxies,
        implement Security Preconditions <xref
        target="I-D.ietf-mmusic-securityprecondition"></xref>, or the both
        ends implement ICE <xref target="I-D.ietf-mmusic-ice"></xref> and the
        answerer implements the reliable provisional response mechanism
        described in ICE. Unfortunately, there is not wide deployment of any
        of these techniques and there is industry reluctance to set
        requirements regarding these techniques to avoid the problem described
        in this section.</t>

        <t>Note that the receipt of an SDP answer is not always sufficient to
        allow media to be played to the offerer. Sometimes, the offerer must
        send media in order to open up firewall holes or NAT bindings before
        media can be received. In this case a solution that makes the key
        available before the SDP answer arrives will not help.<!-- Here additional measures as
            using ICE may provide a solution space. --></t>

        <t>Requirements are created due to early media, in the sense of
        pre-offer/answer media, as described in <xref
        target="I-D.barnes-sip-em-ps-req-sol"></xref>. Fixes to early media
        might make the requirements to become obsolete, but at the time of
        writing no progress has been accomplished.</t>
      </section>

      <!-- === -->

      <section anchor="forking" title="Retargeting and Forking">
        <t>In SIP, a request sent to a specific AOR but delivered to a
        different AOR is called a "retarget". A typical scenario is a "call
        forwarding" feature. In <xref target="retargeting_figure"></xref>
        Alice sends an Invite in step 1 that is sent to Bob in step 2. Bob
        responds with a redirect (SIP response code 3xx) pointing to Carol in
        step 3. This redirect typically does not propagate back to Alice but
        only goes to a proxy (i.e., the retargeting proxy) that sends the
        original Invite to Carol in step 4.</t>

        <t><figure anchor="retargeting_figure" title="Retargeting">
            <artwork align="center"><![CDATA[
                +-----+
                |Alice|
                +--+--+
                   |
                   | Invite (1)
                   V
              +----+----+
              |  proxy  |
              ++-+-----++
               | ^     |
    Invite (2) | |     | Invite (4)
& redirect (3) | |     |
               V |     V
              ++-++   ++----+
              |Bob|   |Carol|
              +---+   +-----+
              ]]></artwork>
          </figure></t>

        <t>The mechanism used by SIP for identifying the calling party is SIP
        Identity <xref target="RFC3261"></xref>. However, due to SIP
        retargeting issues <xref
        target="I-D.peterson-sipping-retarget"></xref>, SIP Identity can only
        identify the calling party (that is, the party that initiated the SIP
        request). Some key exchange mechanisms predate SIP Identity and
        include their own identity mechanism. However, those built-in identity
        mechanism suffer from the same SIP retargeting problem described in
        the above draft. Going forward, <xref target="RFC4916">Connected Identity</xref>
        allows identifying the called party.  This is also described as
        the 'retargeting identity' problem.</t>

        <t>In SIP, 'forking' is the delivery of a request to multiple
        locations. This happens when a single AOR is registered more than
        once. An example of forking is when a user has a desk phone, PC
        client, and mobile handset all registered with the same AOR.</t>

        <t><figure anchor="forking_figure" title="Forking">
            <artwork align="center"><![CDATA[
         +-----+
         |Alice|
         +--+--+
            |
            | Invite
            V
      +-----+-----+
      |   proxy   |
      ++---------++
       |         |
Invite |         | Invite
       V         V
    +--+--+   +--+--+
    |Bob-1|   |Bob-2|
    +-----+   +-----+
]]></artwork>
          </figure></t>

        <t>With forking, both Bob-1 and Bob-2 might send back SDP answers in
        SIP responses. Alice will see those intermediate (18x) and final (200)
        responses. It is useful for Alice to be able to associate the SIP
        response with the incoming media stream. Although this association can
        be done with ICE <xref target="I-D.ietf-mmusic-ice"></xref>, and ICE
        is useful to make this association with RTP, it is not desirable to
        require ICE to accomplish this association.</t>

        <t>Forking and retargeting are often used together. For example, a
        boss and secretary might have both phones ring and rollover to voice
        mail if neither phone is answered.</t>

        <t>To maintain security of the media traffic, only the end point that
        answers the call should know the SRTP keys for the session. This is
        only an issue with public key encryption and not with DH-based
        approaches. For key exchange mechanisms that do not provide secure
        forking or secure retargeting, one workaround is to re-key immediately
        after forking or retargeting (that is, perform a re-Invite). However,
        because the originator may not be aware that the call forked this
        mechanism requires rekeying immediately after every session is
        established. This doubles the Invite messages processed by the
        network.</t>

        <t>Retargeting securely introduces a more significant problem. With
        retargeting, the actual recipient of the request is not the original
        recipient. This means that if the offerer encrypted material (such as
        the session key or the SDP) using the original recipient's public key,
        the actual recipient will not be able to decrypt that material because
        the recipient won't have the original recipient's private key. In some
        cases, this is the intended behavior, i.e., you wanted to establish a
        secure connection with a specific individual. In other cases, it is
        not intended behavior (you want all voice media to be encrypted,
        regardless of who answers).</t>

        <t>For some forms of key management the calling party needs to know in
        advance the certificate or shared secret of the called party, and
        retargeting can interfere with this.</t>

        <t>Further compounding this problem is a particularity of SIP that
        when forking is used, there is always only one final error response
        delivered to the sender of the request: the forking proxy is
        responsible for choosing which final response to choose in the event
        where forking results in multiple final error responses being received
        by the forking proxy. This means that if a request is rejected, say
        with information that the keying information was rejected and
        providing the far end's credentials, it is very possible that the
        rejection will never reach the sender. This problem, called the <xref
        target="I-D.mahy-sipping-herfp-fix">Heterogeneous Error Response
        Forking Problem (HERFP)</xref>, is difficult to solve in SIP.</t>
      </section>

      <!--
      <section anchor="ICE4association" title="Using ICE to Associate Media and Signaling">
        <t>In the absence of a technique in the key exchange to associate SIP signaling with the
          media, ICE may be used. This technique does not need an external STUN server or external
          TURN server; rather, what is used are ICE connectivity checks:</t>

        <t>
          <list style="symbols">
            <t>The offer has at least one a=candidate line, matching the m/c lines</t>

            <t>The answerer has to minimally support the new 'lite' mode of ICE. This means the
              answerer's SDP also has an a=candidate line that matches its m/c lines. In ICE's
              'lite' mode, the answerer only responds to STUN Binding Requests.</t>

            <t>There are two ways the offerer will notice forking occurred:</t>
            <list style="symbols">
              <t>media (RTP or SRTP) arrives from different transport addresses</t>

              <t>STUN connectivity checks with different STUN usernames arrive from different
                transport addresses</t>

              <t>multiple answers arrive in SIP signaling</t>
            </list>

            <t>When the offerer notices forking occurred, and the offerer needs to associate an SDP
              answer with the media path, the offerer can send a STUN Binding Request to the address
              specified in the SDP and perform ICE triggered checks, as specified by ICE. This
              allows correlating the media path with the endpoint that generated the SDP answer.</t>
          </list>
        </t>
        <t>[Editor's Note: Even though this describes a possible solution in a requirements
          document, we listed it for further comments.]</t>
      </section>

-->

      <!-- === -->

      <section anchor="conferencing" title="Shared Key Conferencing">
        <t>For efficient scaling, large audio and video conference bridges
        operate most efficiently by encrypting the current speaker once and
        distributing that stream to the conference attendees. Typically,
        inactive participants receive the same streams -- they hear (or see)
        the active speaker(s), and the active speakers receive distinct
        streams that don't include themselves. In order to maintain
        confidentiality of such conferences where listeners share a common
        key, all listeners must rekeyed when a listener joins or leaves a
        conference.</t>

        <t>An important use case for mixers/translators is a conference
        bridge:</t>

        <t><figure anchor="figure_centralized_keying"
            title="Centralized Keying">
            <artwork align="center"><![CDATA[
            +----+
A --- 1 --->|    |
  <-- 2 ----| M  |
            | I  |
B --- 3 --->| X  |
  <-- 4 ----| E  |
            | R  |
C --- 5 --->|    |
  <-- 6 ----|    |
            +----+
              ]]></artwork>
          </figure></t>

        <t>In the figure above, 1, 3, and 5 are RTP media contributions from
        Alice, Bob, and Carol, and 2, 4, and 6 are the RTP flows to those
        devices carrying the 'mixed' media.</t>

        <t>Several scenarios are possible:</t>

        <t><list style="letters">
            <t>Multiple inbound sessions: 1, 3, and 5 are distinct RTP
            sessions,</t>

            <t>Multiple outbound sessions: 2, 4, and 6 are distinct RTP
            sessions,</t>

            <t>Single inbound session: 1, 3, and 5 are just different sources
            within the same RTP session,</t>

            <t>Single outbound session: 2, 4, and 6 are different flows of the
            same (multi-unicast) RTP session</t>
          </list></t>

        <t>If there are multiple inbound sessions and multiple outbound
        sessions (scenarios a and b), then every keying mechanism behaves as
        if the mixer were an end point and can set up a point-to-point secure
        session between the participant and the mixer. This is the simplest
        situation, but is computationally wasteful, since SRTP processing has
        to be done independently for each participant. The use of multiple
        inbound sessions (scenario a) doesn't waste computational resources,
        though it does consume additional cryptographic context on the mixer
        for each participant and has the advantage of non-repudiation of the
        originator of the incoming stream.</t>

        <t>To support a single outbound session (scenario d), the mixer has to
        dictate its encryption key to the participants. Some keying mechanisms
        allow the transmitter to determine its own key, and others allow the
        offerer to determine the key for the offerer and answerer. Depending
        on how the call is established, the offerer might be a participant
        (such as a participant dialing into a conference bridge) or the
        offerer might be the mixer (such as a conference bridge calling a
        participant). The use of offerless Invites may help some keying
        mechanisms reverse the role of offerer/answerer. A difficulty,
        however, is knowing a priori if the role should be reversed for a
        particular call.</t>
      </section>
    </section>

    <section anchor="requirements" title="Requirements">
      <t><list hangIndent="7" style="format R%d:">
          <t>Negotiation of SRTP keys MUST NOT cause the call
          setup to fail in forked and retargeted calls where all end points
          are willing to use SRTP, unless the execution of the authentication
          and key exchange protocol leads to a failure (e.g., an unsuccessful
          authentication attempt).</t>

          <t><!-- Forking and retargeting MUST allow establishing SRTP or RTP with a
              mixture of SRTP- and RTP-capable targets, such that SRTP is performed with SRTP-capable
              targets and RTP targets do not cause Heterogeneous Error Response Forking Problem
              (HERFP).
              -->Even when some end points of a forked or retargeted call are
          incapable of using SRTP, the key management protocol MUST allow the
          establishment of SRTP associations with SRTP-capable endpoints and /
          or RTP associations with non-SRTP-capable endpoints.</t>

          <t>Forked end points MUST NOT know the SRTP key of
          any call established with another forked end point.</t>

          <t>The media security key management protocol MAY
          support the ability to utilize an initially established security
          context that was established as part of the first call setup with a
          remote end point.<vspace blankLines="1" /> Specialized devices may
          need to avoid public key operations or Diffie-Hellman operations as
          much as possible because of the computational cost or because of the
          additional call setup delay. For example, it can take a second or
          two to perform a Diffie-Hellman operation in certain devices.
          Examples of these specialized devices would include some handsets,
          intelligent SIMs, and PSTN gateways. For the typical case because a
          phone call has not yet been established, ancillary processing cycles
          can be utilized to perform the PK or DH operation; for example, in a
          PSTN gateway the DSP, which is not yet involved with typical DSP
          operations, could be used to perform the calculation, so as to avoid
          having the central host processor perform the calculation. Some
          devices, such as handsets, and intelligent SIMs do not have such
          ancillary processing capability.</t>

          <t>The media security key management protocol SHOULD
          avoid clipping media before SDP answer without requiring PRACK <xref
          target="RFC3262"></xref>.</t>

          <t>The media security key management protocol MUST
          provide protection against passive attacks on the media path.</t>

          <t>The media security key management protocol MUST
          provide protection against passive attacks of a SIP proxy that is
          legitimately routing SIP messages.</t>

          <t>The media security key management protocol MUST be
          able to support perfect forward secrecy (or PFS). The term PFS is
          the property that disclosure of the long-term secret keying material
          that is used to derive an agreed ephemeral key does not compromise
          the secrecy of agreed keys from earlier runs.</t>

          <t>The media security key management protocol MUST
          support negotiation of SRTP cipher suites without incurring
          per-algorithm computational expense. This allows an offer to be
          built without incurring computational expense for each
          algorithm.</t>

          <t>If SRTP keying is performed over the media path,
          the keying packets MUST NOT pass the RTP validity check defined in
          Appendix A.1 of <xref target="RFC3550"></xref>.</t>

          <t>The media security key management protocol that
          utilizes expensive cryptographic computations SHOULD offer the
          ability to resume previous sessions in an efficient way. <!-- R10 is also about using the same DTLS session for RTCP and RTP.
              R10 is talking about using the same PK operation (and DH) operation for your m=audio, m=video, m=application sessions.
            --></t>

          <t>The media security key management protocol MUST
          NOT require 3rd parties to sign certificates.<vspace
          blankLines="1" />This requirement points to the fact that a global
          PKI cannot be assumed and opportunistic security approaches should
          be considered as part of the solution.</t>

          <t>The media security key management protocol SHOULD
          use algorithms that allow <xref target="FIPS-140-2">FIPS
          140-2</xref> certification. <vspace blankLines="1" /> Note that the
          United States Government can only purchase and use crypto
          implementations that have been validated by the <xref
          target="FIPS-140-2">FIPS-140</xref> process: <vspace
          blankLines="1" /> "The FIPS-140 standard is applicable to all
          Federal agencies that use cryptographic-based security systems to
          protect sensitive information in computer and telecommunication
          systems, including voice systems. The adoption and use of this
          standard is available to private and commercial organizations."<xref
          target="cryptval"></xref> <vspace blankLines="1" /> Some commercial
          organizations, such as banks and defense contractors, also require
          or prefer equipment which has validated by the FIPS-140 process.</t>

          <t>The media security key management protocol SHOULD
          be able to associate the signaling exchange with the media
          traffic.<vspace blankLines="1" />
For example, if using a Diffie-Hellman keying technique with
          security preconditions that forks to 20 end points, the call
          initiator would get 20 provisional responses containing 20 signed
          Diffie-Hellman key pairs. Calculating 20 DH secrets and validating
          signatures can be a difficult task depending on the device
          capabilities. Hence, in the case of forking, it is not desirable to
          perform a DH or PK operation with every party, but rather only with
          the party that answers the call (and incur some media clipping). To
          do this, the signaling and media need to be associated so the
          calling party knows which key management needs to be completed. This
          might be done by using the transport address indicated in the SDP,
          although NATs can complicate this association.
<vspace blankLines="1" />
Allowing such an association also allows the SDP offerer to avoid performing
CPU-consuming operations (e.g., DH or public key operations) with attackers
that have not seen the signaling messages.
</t>

          <!--  <t>[Editor's Note: There are different options to achieve the association of signaling and
            media, which need to be discussed. One option may be requiring the use of symmetric RTP
            when applying SRTP. The only time this doesn't work is when NATs are involved. For this
            case we may rely on ICE (see "Interactions with Forking" in <xref
              target="I-D.ietf-mmusic-ice"/> or also the in section <xref target="ICE4association"/></t>
-->

          <t>The media security key management protocol SHOULD
          allow to start with RTP and then upgrade to SRTP. <!-- Dan: opportunistic probing. Hannes: Start with RTP (in case of early media) and then upgrade. --></t>

          <t>The media security key management protocol SHOULD
          NOT introduce new denial of service vulnerabilities.</t>

          <t>The media security key management protocol SHOULD
          require the adversary to have access to the data as well as the
          signaling path for a successful attack to be launched. An adversary
          that is located only along the data or only along the signaling path
          MUST NOT be able to successfully mount an attack. A successful
          attack refers to the ability for the adversary to obtain keying
          material to decrypt the SRTP encrypted media traffic.</t>

          <!-- <t hangText="R17:">The media security key management protocol SHOULD support the
            possibility to protect non-RTP-based data traffic.
      </t>

          -->

          <t>If two parties share an authentication
          infrastructure that has 3rd parties signing certificates, they
          SHOULD be able to make use of it.</t>

          <t>The media security key management protocol MUST
          provide crypto-agility.</t>

          <t>The media security key management protocol MUST
          protect cipher suite negotiation against downgrading attacks.</t>

          <t hangText="R21:">The media security key management protocol MUST
          allow a SIP User Agent to negotiate media security parameters for
          each individual session.</t>

          <t>The media security key management protocol SHOULD
          allow establishing SRTP keying between different call signaling
          protocols (e.g., between Jabber, SIP, H.323, MGCP)</t>

          <t>The media security key management protocol SHOULD
          support recording of decrypted media.<vspace blankLines="1" /> Media
          recording may be realized by an intermediate nodes. An example for
          those intermediate nodes are devices, which could be used in banking
          applications or for quality monitoring in call centers. Here, it
          must be ensured, that the media security is ensured by the
          intermediate nodes on the connections to the involved endpoints as
          originally negotiated. The endpoints need to be informed that there
          is an intermediate device and need to cooperate. A solution approach
          for this is described in <xref
          target="I-D.wing-sipping-srtp-key"></xref>.</t>

          <t>The media security key management protocol SHOULD
          NOT allow end users to determine whether their end-to-end
          interaction is subject to lawful interception.</t>

          <t>The media security key management protocol MUST
          work when there are intermediate nodes, terminating or processing
          media, between the end points.</t>

          <t>The media security key management protocol MUST
          consider termination of media security in a PSTN gateway.<vspace
          blankLines="1" />A typical case of using media security is the one
          where two entities are having a VoIP conversation over IP capable
          networks. However, there are cases where the other end of the
          communication is not connected to an IP capable network. In this
          kind of setting, there needs to be some kind of gateway at the edge
          of the IP network which converts the VoIP conversation to format
          understood by the other network. An example of such gateway is a
          PSTN gateway sitting at the edge of IP and PSTN networks.<vspace
          blankLines="1" />If media security (e.g., SRTP protection) is
          employed in this kind of gateway-setting, then media security and
          the related key management needs to be terminated at the gateway.
          The other network (e.g., PSTN) may have its own measures to protect
          the communication, but this means that from media security point of
          view the media security is not employed end-to-end between the
          communicating entities.</t>

          <!--

        <t hangText="R9:">A solution MUST NOT expect packets to be received on the media path
        until 200 OK, because the media path may be blocked by middleboxes until the 200 OK.
        </t>

        This requirement was recently proposed and we did not want to
        consider it. -->
        </list></t>
    </section>

    <section anchor="clustering" title="Requirements Classification">
      <t>An adversary might be located along <list style="numbers">
          <t hangText="(1)">the media path,</t>

          <t hangText="(2)">the signaling path,</t>

          <t hangText="(3)">the media and the signaling path.</t>
        </list></t>

      <t>An attacker that can solely be located along the signaling path, and
      does not have access to media, is not considered (ref item 2).</t>

      <t>Furthermore, it is reasonable to consider the capabilities of the
      adversary. We also have different types of adversaries, namely <list
          style="letters">
          <t hangText="(a)">active adversary</t>

          <t hangText="(b)">passive adversary</t>
        </list></t>

      <t>Note that the adversary model for (a) and (b) also assumes the
      attacker being able to control SIP signaling entities.</t>

      <t>With respect to item (a) an adversary may need to be active with
      regard to the key exchange relevant information traveling along the data
      or the signaling path.</t>

      <t>Some of the deployment variants of the media security key management
      proposals under considerations do not provide protection against
      man-in-the-middle adversaries under certain conditions, for example when
      SIP signaling entities are compromised, when a global PKI is missing or
      pre-shared secrets are not exchanged between the end points prior to the
      protocol exchange.</t>

      <t>Based on the above-mentioned considerations the following
      classifications can be made: <list style="hanging">
          <t hangText="Class I:"><vspace blankLines="1" /> Passive attack on
          the signaling and the data path sufficient to reveal the content of
          the media traffic. <vspace blankLines="1" /></t>

          <t hangText="Class II:"><vspace blankLines="1" /> Active attack on
          the signaling path and passive attack on the data path to reveal the
          content of the media traffic. <vspace blankLines="1" /></t>

          <t hangText="Class III:"><vspace blankLines="1" /> Active attack on
          the signaling and the data path necessary to reveal the content of
          the media traffic. <vspace blankLines="1" /></t>

          <t hangText="Class IV:"><vspace blankLines="1" /> Active attack is
          required and will be detected by the end points when adversary
          tampers with the messages.</t>
        </list></t>

      <t>For example, SDES falls into Class I since the adversary needs to
      learn the SDES key by progressing a signaling message at a SIP proxy
      (assuming that the adversary is in control of the SIP proxy). Subsequent
      media traffic can be decrypted with the help of the learned key.</t>

      <t>As another example, DTLS-RTP falls into Class III when DTLS is used a
      public key based ciphersuite with self-signed certificates and without
      SIP Identity. An adversary would have to modify the fingerprint that is
      sent along the signaling path and subsequently to modify the
      certificates carried in the DTLS handshake that travel along the media
      path.</t>

      <t>An attack is not successful when SIP Identity is used, the adversary
      is not between the SIP UA and its Authentication Service (or at the
      Authentication Service), both end points are able to verify the digital
      signature (of the SIP Identity) and are able to validate the
      corresponding certificates.</t>
    </section>

    <section anchor="security" title="Security Considerations">
      <t>This document lists requirements for securing media traffic. As such,
      it addresses security throughout the document.</t>
    </section>

    <section anchor="iana" title="IANA Considerations">
      <t>This document does not require actions by IANA.</t>
    </section>

    <section anchor="acks" title="Acknowledgements">

      <t>For contributions to the requirements portion of this document, the authors
      would like to thank the active participants of the RTPSEC
      BoF and on the RTPSEC mailing list. The authors would furthermore like
      to thank Wolfgang Buecker, Guenther Horn, Peter Howard, Hans-Heinrich
      Grusdt, Srinath Thiruvengadam, Martin Euchner, Eric Rescorla, Matt
      Lepinski, Dan York, Werner Dittmann, Richard Barnes, Vesa Lehtovirta,
      Colin Perkins, Peter Schneider, and Christer Holmberg for their feedback
      to this document.</t>

      <t>For contributions to the analysis portion of this document,
      the authors would like to thank Special thanks to Steffen Fries and Dragan
     Ignjatic for their
      excellent <xref target="I-D.ietf-msec-mikey-applicability">MIKEY
      comparison document</xref>. The authors would furthermore like to thank
Cullen Jennings, David Oran,
      David McGrew, Mark Baugher, Flemming Andreasen, Eric Raymond, Dave Ward,
      Leo Huang, Eric Rescorla, Lakshminath Dondeti, Steffen Fries, Alan
      Johnston, Dragan Ignjatic and John Elwell for their feedback to this
      document.</t>
    </section>
  </middle>

  <back>
    <references title="Normative References">
      &RFC2119;

      &RFC3261;

      &RFC3262;

      &RFC3264;

      &RFC3711;

      <reference anchor="FIPS-140-2"
                 target="http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf">
        <front>
          <title>Security Requirements for Cryptographic Modules</title>

          <author fullname="NIST">
            <organization>NIST</organization>
          </author>

          <date day="13" month="June" year="2005" />
        </front>
      </reference>

      <reference anchor="cryptval"
                 target="http://csrc.nist.gov/cryptval/140-2APP.htm">
        <front>
          <title>Cryptographic Module Validation Program</title>

          <author fullname="NIST">
            <organization>NIST</organization>
          </author>

          <date day="19" month="December" year="2006" />
        </front>
      </reference>
    </references>

    <references title="Informative References">
      &I-D.ietf-mmusic-securityprecondition;

      &RFC3550;

      &I-D.ietf-mmusic-ice;

      &I-D.peterson-sipping-retarget;

      &RFC4474;

      &I-D.barnes-sip-em-ps-req-sol;

      &I-D.wing-sipping-srtp-key;

      &rfc4568;

      &rfc4650;

      &I-D.ietf-msec-mikey-ecc;

      &rfc4738;

      &I-D.ietf-sip-certs;

      &I-D.mahy-sipping-herfp-fix;

      &rfc3830;

      &rfc4492;

      &rfc3388;

      &rfc4346;

      &rfc4916;

      &I-D.fischl-sipping-media-dtls;

      &I-D.ietf-msec-mikey-applicability;

      &I-D.zimmermann-avt-zrtp;

      &I-D.baugher-mmusic-sdp-dh;

      &I-D.mcgrew-srtp-ekt;

      &rfc4771;

      &I-D.jennings-sipping-multipart;

      &I-D.mcgrew-tls-srtp;

      &I-D.dondeti-msec-rtpsec-mikeyv2;

      &I-D.ietf-mmusic-sdp-capability-negotiation;
    </references>

    <section anchor="comparison" title="Overview of Keying Mechanisms">
      <t>Based on how the SRTP keys are exchanged, each SRTP key exchange
      mechanism belongs to one general category:</t>

      <t><list>
          <t><list style="hanging">
              <t hangText="signaling path:">All the keying is carried in the
              call signaling (SIP or SDP) path.</t>

              <t hangText="media path:">All the keying is carried in the
              SRTP/SRTCP media path, and no signaling whatsoever is carried in
              the call signaling path.</t>

              <t hangText="signaling and media path:">Parts of the keying are
              carried in the SRTP/SRTCP media path, and parts are carried in
              the call signaling (SIP or SDP) path.</t>
            </list></t>
        </list></t>

      <t>One of the significant benefits of SRTP over other end-to-end
      encryption mechanisms, such as for example IPsec, is that SRTP is
      bandwidth efficient and SRTP retains the header of RTP packets.
      Bandwidth efficiency is vital for VoIP in many scenarios where access
      bandwidth is limited or expensive, and retaining the RTP header is
      important for troubleshooting packet loss, delay, and jitter.</t>

      <t>Related to SRTP's characteristics is a goal that any SRTP keying
      mechanism to also be efficient and not cause additional call setup
      delay. Contributors to additional call setup delay include network or
      database operations: retrieval of certificates and additional SIP or
      media path messages, and computational overhead of establishing keys or
      validating certificates.</t>

      <t>When examining the choice between keying in the signaling path,
      keying in the media path, or keying in both paths, it is important to
      realize the media path is generally 'faster' than the SIP signaling
      path. The SIP signaling path has computational elements involved which
      parse and route SIP messages. The media path, on the other hand, does
      not normally have computational elements involved, and even when
      computational elements such as firewalls are involved, they cause very
      little additional delay. Thus, the media path can be useful for
      exchanging several messages to establish SRTP keys. A disadvantage of
      keying over the media path is that interworking different key exchange
      requires the interworking function be in the media path, rather than
      just in the signaling path; in practice this involvement is probably
      unavoidable anyway.</t>

      <section title="Signaling Path Keying Techniques">
        <section title="MIKEY-NULL">
          <t><xref target="RFC3830">MIKEY-NULL</xref> has the offerer indicate
          the SRTP keys for both directions. The key is sent unencrypted in
          SDP, which means the SDP must be encrypted hop-by-hop (e.g., by
          using TLS (SIPS)) or end-to-end (e.g., by using S/MIME).</t>

          <t>MIKEY-NULL requires one message from offerer to answerer (half a
          round trip), and does not add additional media path messages.</t>
        </section>

        <section title="MIKEY-PSK">
          <t>MIKEY-PSK (pre-shared key) <xref target="RFC3830"></xref>
          requires that all endpoints share one common key. MIKEY-PSK has the
          offerer encrypt the SRTP keys for both directions using this
          pre-shared key.</t>

          <t>MIKEY-PSK requires one message from offerer to answerer (half a
          round trip), and does not add additional media path messages.</t>
        </section>

        <section title="MIKEY-RSA">
          <t><xref target="RFC3830">MIKEY-RSA</xref> has the offerer encrypt
          the keys for both directions using the intended answerer's public
          key, which is obtained from a PKI.</t>

          <t>MIKEY-RSA requires one message from offerer to answerer (half a
          round trip), and does not add additional media path messages.
          MIKEY-RSA requires the offerer to obtain the intended answerer's
          certificate.</t>
        </section>

        <section title="MIKEY-RSA-R">
          <t>MIKEY-RSA-R <xref target="RFC4738">An additional mode of key
          distribution in MIKEY: MIKEY-RSA-R</xref> is essentially the same as
          MIKEY-RSA but reverses the role of the offerer and the answerer with
          regards to providing the keys. That is, the answerer encrypts the
          keys for both directions using the offerer's public key. Both the
          offerer and answerer validate each other's public keys using a PKI.
          MIKEY-RSA-R also enables sending certificates in the MIKEY
          message.</t>

          <t>MIKEY-RSA-R requires one message from offerer to answer, and one
          message from answerer to offerer (full round trip), and does not add
          additional media path messages. MIKEY-RSA-R requires the offerer
          validate the answerer's certificate.</t>
        </section>

        <section title="MIKEY-DHSIGN">
          <t><xref target="RFC3830">In MIKEY-DHSIGN</xref> the offerer and
          answerer derive the key from a Diffie-Hellman exchange. In order to
          prevent an active man-in-the-middle the DH exchange itself is signed
          using each endpoint's private key and the associated public keys are
          validated using a PKI.</t>

          <t>MIKEY-DHSIGN requires one message from offerer to answerer, and
          one message from answerer to offerer (full round trip), and does not
          add additional media path messages. MIKEY-DHSIGN requires the
          offerer and answerer to validate each other's certificates.
          MIKEY-DHSIGN also enables sending the answerer's certificate in the
          MIKEY message.</t>
        </section>

        <section title="MIKEY-DHHMAC">
          <t><xref target="RFC4650">MIKEY-DHHMAC</xref> uses a pre-shared
          secret to HMAC the Diffie-Hellman exchange, essentially combining
          aspects of MIKEY-PSK with MIKEY-DHSIGN, but without MIKEY-DHSIGN's
          need for a PKI to authenticate the Diffie-Hellman exchange.</t>

          <t>MIKEY-DHHMAC requires one message from offerer to answerer, and
          one message from answerer to offerer (full round trip), and does not
          add additional media path messages.</t>
        </section>

        <section title="MIKEY-ECIES and MIKEY-ECMQV (MIKEY-ECC)">
          <t><xref target="I-D.ietf-msec-mikey-ecc">ECC Algorithms For
          MIKEY</xref> describes how ECC can be used with MIKEY-RSA (using
          ECDSA signature) and with MIKEY-DHSIGN (using a new DH-Group code),
          and also defines two new ECC-based algorithms, Elliptic Curve
          Integrated Encryption Scheme (ECIES) and Elliptic Curve
          Menezes-Qu-Vanstone (ECMQV) .</t>

          <t>For the purposes of this paper, the ECDSA signature, MIKEY-ECIES,
          and MIKEY-ECMQV function exactly like MIKEY-RSA, and the new
          DH-Group code function exactly like MIKEY-DHSIGN. Therefore these
          ECC mechanisms aren't discussed separately in this paper.</t>
        </section>

        <section anchor="sdesc" title="Security Descriptions with SIPS">
          <t><xref target="RFC4568">Security Descriptions</xref> has each side
          indicate the key it will use for transmitting SRTP media, and the
          keys are sent in the clear in SDP. Security Descriptions relies on
          hop-by-hop (TLS via "SIPS:") encryption to protect the keys
          exchanged in signaling.</t>

          <t>Security Descriptions requires one message from offerer to
          answerer, and one message from answerer to offerer (full round
          trip), and does not add additional media path messages.</t>
        </section>

        <section title="Security Descriptions with S/MIME">
          <t>This keying mechanism is identical to <xref
          target="sdesc"></xref>, except that rather than protecting the
          signaling with TLS, the entire SDP is encrypted with S/MIME.</t>
        </section>

        <section title="SDP-DH (expired)">
          <t><xref target="I-D.baugher-mmusic-sdp-dh">SDP
          Diffie-Hellman</xref> exchanges Diffie-Hellman messages in the
          signaling path to establish session keys. To protect against active
          man-in-the-middle attacks, the Diffie-Hellman exchange needs to be
          protected with S/MIME, SIPS, or <xref
          target="RFC4474">SIP-Identity</xref> and <xref
          target="RFC4474"></xref>.</t>

          <t>SDP-DH requires one message from offerer to answerer, and one
          message from answerer to offerer (full round trip), and does not add
          additional media path messages.</t>
        </section>

        <section anchor="mikey2-sdp" title="MIKEYv2 in SDP (expired)">
          <t><xref target="I-D.dondeti-msec-rtpsec-mikeyv2">MIKEYv2</xref>
          adds mode negotiation to MIKEYv1 and removes the time
          synchronization requirement. It therefore now takes 2 round-trips to
          complete. In the first round trip, the communicating parties learn
          each other's identities, agree on a MIKEY mode, crypto algorithm,
          SRTP policy, and exchanges nonces for replay protection. In the
          second round trip, they negotiate unicast and/or group SRTP context
          for SRTP and/or SRTCP.</t>

          <t>Furthemore, MIKEYv2 also defines an in-band negotiation mode as
          an alternative to SDP (see <xref
          target="mikey2-inband"></xref>).</t>
        </section>
      </section>

      <section title="Media Path Keying Technique">
        <t></t>

        <section title="ZRTP">
          <t><xref target="I-D.zimmermann-avt-zrtp">ZRTP</xref> does not
          exchange information in the signaling path (although it's possible
          for endpoints to indicate support for ZRTP with "a=zrtp" in the
          initial Offer). In ZRTP the keys are exchanged entirely in the media
          path using a Diffie-Hellman exchange. The advantage to this
          mechanism is that the signaling channel is used only for call setup
          and the media channel is used to establish an encrypted channel --
          much like encryption devices on the PSTN. ZRTP uses voice
          authentication of its Diffie-Hellman exchange by having each person
          read digits to the other person. Subsequent sessions with the same
          ZRTP endpoint can be authenticated using the stored hash of the
          previously negotiated key rather than voice authentication.</t>

          <t>ZRTP uses 4 media path messages (Hello, Commit, DHPart1, and
          DHPart2) to establish the SRTP key, and 3 media path confirmation
          messages. The first 4 are sent as RTP packets (using RTP header
          extensions), and the last 3 are sent in conjunction with SRTP media
          packets (again as SRTP header extensions). Note that unencrypted RTP
          is being exchanged until the SRTP keys are established.</t>
        </section>
      </section>

      <section title="Signaling and Media Path Keying Techniques">
        <t></t>

        <section title="EKT">
          <t><xref target="I-D.mcgrew-srtp-ekt">EKT</xref> relies on another
          SRTP key exchange protocol, such as Security Descriptions or MIKEY,
          for bootstrapping. In the initial phase, each member of a conference
          uses an SRTP key exchange protocol to establish a common key
          encryption key (KEK). Each member may use the KEK to securely
          transport its SRTP master key and current SRTP rollover counter
          (ROC), via RTCP, to the other participants in the session.</t>

          <t>EKT requires the offerer to send some parameters (EKT_Cipher,
          KEK, and security parameter index (SPI)) via the bootstrapping
          protocol such as Security Descriptions or MIKEY. Each answerer sends
          an SRTCP message which contains the answerer's SRTP Master Key,
          rollover counter, and the SRTP sequence number. Rekeying is done by
          sending a new SRTCP message. For reliable transport, multiple RTCP
          messages need to be sent.</t>
        </section>

        <section anchor="dtls-srtp" title="DTLS-SRTP">
          <t><xref target="I-D.mcgrew-tls-srtp">DTLS-SRTP</xref> exchanges
          public key fingerprints in SDP <xref
          target="I-D.fischl-sipping-media-dtls"></xref> and then establishes
          a DTLS session over the media channel. The endpoints use the DTLS
          handshake to agree on crypto suites and establish SRTP session keys.
          SRTP packets are then exchanged between the endpoints.</t>

          <t>DTLS-SRTP requires one message from offerer to answerer (half
          round trip), and, if the offerer wishes to correlate the SDP answer
          with the endpoint, requires one message from answer to offerer (full
          round trip). DTLS-SRTP uses 4 media path messages to establish the
          SRTP key.</t>

          <t>This paper assumes DTLS will use TLS_RSA_WITH_3DES_EDE_CBC_SHA as
          its cipher suite, which is the mandatory-to-implement cipher suite
          in <xref target="RFC4346">TLS</xref>.</t>

        </section>

        <section anchor="mikey2-inband" title="MIKEYv2 Inband (expired)">
          <t>As defined in <xref target="mikey2-sdp"></xref>, MIKEYv2 also
          defines an in-band negotiation mode as an alternative to SDP (see
          <xref target="mikey2-inband"></xref>). The details are not sorted
          out in the draft yet on what in-band actually means (i.e., UDP, RTP,
          RTCP, etc.).</t>
        </section>
      </section>
    </section>

    <section title="Evaluation Criteria - SIP">
      <t>This section considers how each keying mechanism interacts with SIP
      features.</t>

      <section anchor="retargeting"
               title="Secure Retargeting and Secure Forking">
        <t></t>

        <t> Retargeting and forking of signaling requests is described
        within <xref target="forking"></xref>. The following builds upon this
        description.</t>

        <t>The following list compares the behavior of secure forking,
        answering association, two-time pads, and secure retargeting for each
        keying mechanism.</t>

        <t><list>
            <t><list style="hanging">
                <t hangText="MIKEY-NULL">Secure Forking: No, all AORs see
                offerer's and answerer's keys. Answer is associated with media
                by the SSRC in MIKEY. Additionally, a two-time pad occurs if
                two branches choose the same 32-bit SSRC and transmit SRTP
                packets.<vspace blankLines="1" />Secure Retargeting: No, all
                targets see offerer's and answerer's keys. Suffers from
                retargeting identity problem.</t>

                <t hangText="MIKEY-PSK"><vspace blankLines="0" />Secure
                Forking: No, all AORs see offerer's and answerer's keys.
                Answer is associated with media by the SSRC in MIKEY. Note
                that all AORs must share the same pre-shared key in order for
                forking to work at all with MIKEY-PSK. Additionally, a
                two-time pad occurs if two branches choose the same 32-bit
                SSRC and transmit SRTP packets.<vspace blankLines="1" />Secure
                Retargeting: Not secure. For retargeting to work, the final
                target must possess the correct PSK. As this is likely in
                scenarios were the call is targeted to another device
                belonging to the same user (forking), it is very unlikely that
                other users will possess that PSK and be able to successfully
                answer that call.</t>

                <t hangText="MIKEY-RSA"><vspace blankLines="0" />Secure
                Forking: No, all AORs see offerer's and answerer's keys.
                Answer is associated with media by the SSRC in MIKEY. Note
                that all AORs must share the same private key in order for
                forking to work at all with MIKEY-RSA. Additionally, a
                two-time pad occurs if two branches choose the same 32-bit
                SSRC and transmit SRTP packets.<vspace blankLines="1" />Secure
                Retargeting: No.</t>

                <t hangText="MIKEY-RSA-R"><vspace blankLines="0" />Secure
                Forking: Yes. Answer is associated with media by the SSRC in
                MIKEY.<vspace blankLines="1" />Secure Retargeting: Yes.</t>

                <t hangText="MIKEY-DHSIGN"><vspace blankLines="0" />Secure
                Forking: Yes, each forked endpoint negotiates unique keys with
                the offerer for both directions. Answer is associated with
                media by the SSRC in MIKEY.<vspace blankLines="1" />Secure
                Retargeting: Yes, each target negotiates unique keys with the
                offerer for both directions.</t>

                <t hangText="MIKEYv2 in SDP"><vspace blankLines="0" />The
                behavior will depend on which mode is picked.</t>

                <t hangText="MIKEY-DHHMAC"><vspace blankLines="0" />Secure
                Forking: Yes, each forked endpoint negotiates unique keys with
                the offerer for both directions. Answer is associated with
                media by the SSRC in MIKEY.<vspace blankLines="1" />Secure
                Retargeting: Yes, each target negotiates unique keys with the
                offerer for both directions. Note that for the keys to be
                meaningful, it would require the PSK to be the same for all
                the potential intermediaries, which would only happen within a
                single domain.</t>

                <t hangText="Security Descriptions with SIPS"><vspace
                blankLines="0" />Secure Forking: No. Each forked endpoint sees
                the offerer's key. Answer is not associated with media.<vspace
                blankLines="1" />Secure Retargeting: No. Each target sees the
                offerer's key.</t>

                <t hangText="Security Descriptions with S/MIME"><vspace
                blankLines="0" />Secure Forking: No. Each forked endpoint sees
                the offerer's key. Answer is not associated with media.<vspace
                blankLines="1" />Secure Retargeting: No. Each target sees the
                offerer's key. Suffers from retargeting identity problem.</t>

                <t hangText="SDP-DH"><vspace blankLines="0" />Secure Forking:
                Yes. Each forked endpoint calculates a unique SRTP key. Answer
                is not associated with media.<vspace blankLines="1" />Secure
                Retargeting: Yes. The final target calculates a unique SRTP
                key.</t>

                <t hangText="ZRTP"><vspace blankLines="0" />Secure Forking:
                Yes. Each forked endpoint calculates a unique SRTP key. As
                ZRTP isn't signaled in SDP, there is no association of the
                answer with media.<vspace blankLines="1" />Secure Retargeting:
                Yes. The final target calculates a unique SRTP key.</t>

                <t hangText="EKT"><vspace blankLines="0" />Secure Forking:
                Inherited from the bootstrapping mechanism (the specific MIKEY
                mode or Security Descriptions). Answer is associated with
                media by the SPI in the EKT protocol. Answer is associated
                with media by the SPI in the EKT protocol.<vspace
                blankLines="1" />Secure Retargeting: Inherited from the
                bootstrapping mechanism (the specific MIKEY mode or Security
                Descriptions).</t>

                <t hangText="DTLS-SRTP"><vspace blankLines="0" />Secure
                Forking: Yes. Each forked endpoint calculates a unique SRTP
                key. Answer is associated with media by the certificate
                fingerprint in signaling and certificate in the media
                path.<vspace blankLines="1" /> Secure Retargeting: Yes. The
                final target calculates a unique SRTP key.</t>

                <t hangText="MIKEYv2 Inband"><vspace blankLines="0" />The
                behavior will depend on which mode is picked.</t>
              </list></t>
          </list></t>
      </section>

      <section title="Clipping Media Before SDP Answer">
        <t> Clipping media before receiving the signaling answer is described
        within <xref target="clipping"></xref>. The following builds upon this
        description.</t>

        <t>Furthermore, the problem of clipping gets compounded when forking
        is used. For example, if using a Diffie-Hellman keying technique with
        security preconditions that forks to 20 endpoints, the call initiator
        would get 20 provisional responses containing 20 signed Diffie-Hellman
        half keys. Calculating 20 DH secrets and validating signatures can
        be a difficult task depending on the device capabilities.</t>

        <t>The following list compares the behavior of clipping before SDP
        answer for each keying mechanism.</t>

        <t><list>
            <t><list style="hanging">
                <t hangText="MIKEY-NULL"><vspace blankLines="0" />Not clipped.
                The offerer provides the answerer's keys.</t>

                <t hangText="MIKEY-PSK"><vspace blankLines="0" />Not clipped.
                The offerer provides the answerer's keys.</t>

                <t hangText="MIKEY-RSA"><vspace blankLines="0" />Not clipped.
                The offerer provides the answerer's keys.</t>

                <t hangText="MIKEY-RSA-R"><vspace blankLines="0" />Clipped.
                The answer contains the answerer's encryption key.</t>

                <t hangText="MIKEY-DHSIGN"><vspace blankLines="0" />Clipped.
                The answer contains the answerer's Diffie-Hellman
                response.</t>

                <t hangText="MIKEY-DHHMAC"><vspace blankLines="0" />Clipped.
                The answer contains the answerer's Diffie-Hellman
                response.</t>

                <t hangText="MIKEYv2 in SDP"><vspace blankLines="0" />The
                behavior will depend on which mode is picked.</t>

                <t hangText="Security Descriptions with SIPS"><vspace
                blankLines="0" />Clipped. The answer contains the answerer's
                encryption key.</t>

                <t hangText="Security Descriptions with S/MIME"><vspace
                blankLines="0" />Clipped. The answer contains the answerer's
                encryption key.</t>

                <t hangText="SDP-DH"><vspace blankLines="0" />Clipped. The
                answer contains the answerer's Diffie-Hellman response.</t>

                <t hangText="ZRTP"><vspace blankLines="0" />Not clipped
                because the session intially uses RTP. While RTP is flowing,
                both ends negotiate SRTP keys in the media path and then
                switch to using SRTP.</t>

                <t hangText="EKT"><vspace blankLines="0" />Not clipped, as
                long as the first RTCP packet (containing the answerer's key)
                is not lost in transit. The answerer sends its encryption key
                in RTCP, which arrives at the same time (or before) the first
                SRTP packet encrypted with that key.<list>
                    <t>Note: RTCP needs to work, in the answerer-to-offerer
                    direction, before the offerer can decrypt SRTP media.</t>
                  </list></t>

                <t hangText="DTLS-SRTP"><vspace blankLines="0" />Not clipped.
                Keys are exchanged in the media path without relying on the
                signaling path.</t>

                <t hangText="MIKEYv2 Inband"><vspace blankLines="0" />Not
                clipped. Keys are exchanged in the media path without relying
                on the signaling path.</t>
              </list></t>
          </list></t>
      </section>

      <section title="Centralized Keying">
        <t> Centralized keying is described within 
        <xref target="conferencing"></xref>. The following builds upon this
        description.</t>

        <t>The following list describes how each keying mechanism behaves with
        centralized keying (scenario d) and rekeying.<list>
            <t><list style="hanging">
                <t hangText="MIKEY-NULL"><vspace blankLines="0" />Keying: Yes,
                if offerer is the mixer. No, if offerer is the participant
                (end user).<vspace blankLines="1" />Rekeying: Yes, via
                re-Invite</t>

                <t hangText="MIKEY-PSK"><vspace blankLines="0" />Keying: Yes,
                if offerer is the mixer. No, if offerer is the participant
                (end user).<vspace blankLines="1" />Rekeying: Yes, with a
                re-Invite</t>

                <t hangText="MIKEY-RSA"><vspace blankLines="0" />Keying: Yes,
                if offerer is the mixer. No, if offerer is the participant
                (end user).<vspace blankLines="1" />Rekeying: Yes, with a
                re-Invite</t>

                <t hangText="MIKEY-RSA-R"><vspace blankLines="0" />Keying: No,
                if offerer is the mixer. Yes, if offerer is the participant
                (end user).<vspace blankLines="1" />Rekeying: n/a</t>

                <t hangText="MIKEY-DHSIGN"><vspace blankLines="0" />Keying:
                No; a group-key Diffie-Hellman protocol is not
                supported.<vspace blankLines="1" />Rekeying: n/a</t>

                <t hangText="MIKEY-DHHMAC"><vspace blankLines="0" />Keying:
                No; a group-key Diffie-Hellman protocol is not
                supported.<vspace blankLines="1" />Rekeying: n/a</t>

                <t hangText="MIKEYv2 in SDP"><vspace blankLines="0" />The
                behavior will depend on which mode is picked.</t>

                <t hangText="Security Descriptions with SIPS"><vspace
                blankLines="0" />Keying: Yes, if offerer is the mixer. Yes, if
                offerer is the participant.<vspace blankLines="1" />Rekeying:
                Yes, with a Re-Invite.</t>

                <t hangText="Security Descriptions with S/MIME"><vspace
                blankLines="0" />Keying: Yes, if offerer is the mixer. Yes, if
                offerer is the participant.<vspace blankLines="1" />Rekeying:
                Yes, with a Re-Invite.</t>

                <t hangText="SDP-DH"><vspace blankLines="0" />Keying: No; a
                group-key Diffie-Hellman protocol is not supported.<vspace
                blankLines="1" />Rekeying: n/a</t>

                <t hangText="ZRTP"><vspace blankLines="0" />Keying: No; a
                group-key Diffie-Hellman protocol is not supported.<vspace
                blankLines="1" />Rekeying: n/a</t>

                <t hangText="EKT"><vspace blankLines="0" />Keying: Yes. After
                bootstrapping a KEK using Security Descriptions or MIKEY, each
                member originating an SRTP stream can send its SRTP master
                key, sequence number and ROC via RTCP.<vspace
                blankLines="1" />Rekeying: Yes. EKT supports each sender to
                transmit its SRTP master key to the group via RTCP packets.
                Thus, EKT supports each originator of an SRTP stream to rekey
                at any time.</t>

                <t hangText="DTLS-SRTP"><vspace blankLines="0" />Keying: Yes,
                because with the assumed cipher suite,
                TLS_RSA_WITH_3DES_EDE_CBC_SHA, each end indicates its SRTP
                key.<vspace blankLines="1" />Rekeying: via DTLS in the media
                path.</t>

                <t hangText="MIKEYv2 Inband"><vspace blankLines="0" />The
                behavior will depend on which mode is picked.</t>
              </list></t>
          </list></t>
      </section>

      <section title="SSRC and ROC">
        <t>In SRTP, a cryptographic context is defined as the SSRC,
        destination network address, and destination transport port number.
        Whereas RTP, a flow is defined as the destination network address and
        destination transport port number. This results in a problem -- how to
        communicate the SSRC so that the SSRC can be used for the
        cryptographic context.</t>

        <t>Two approaches have emerged for this communication. One, used by
        all MIKEY modes, is to communicate the SSRCs to the peer in the MIKEY
        exchange. Another, used by Security Descriptions, is to use "late
        bindng" -- that is, any new packet containing a previously-unseen SSRC
        (which arrives at the same destination network address and destination
        transport port number) will create a new cryptographic context.
        Another approach, common amongst techniques with media-path SRTP key
        establishment, is to require a handshake over that media path before
        SRTP packets are sent. MIKEY's approach changes RTP's SSRC collision
        detection behavior by requiring RTP to pre-establish the SSRC values
        for each session.</t>

        <t>Another related issue is that SRTP introduces a rollover counter
        (ROC), which records how many times the SRTP sequence number has
        rolled over. As the sequence number is used for SRTP's default
        ciphers, it is important that all endpoints know the value of the ROC.
        The ROC starts at 0 at the beginning of a session.</t>

        <t>Some keying mechanisms cause a two-time pad to occur if two
        endpoints of a forked call have an SSRC collision.</t>

        <t>Note: A proposal has been made to send the ROC value on every Nth
        SRTP packet<xref target="RFC4771"></xref>. This proposal has not yet
        been incorporated into this document.</t>

        <t>The following list examines handling of SSRC and ROC:</t>

        <t><list>
            <t><list style="hanging">
                <t hangText="MIKEY-NULL"><vspace blankLines="0" />Each
                endpoint indicates a set of SSRCs and the ROC for SRTP packets
                it transmits.</t>

                <t hangText="MIKEY-PSK"><vspace blankLines="0" />Each endpoint
                indicates a set of SSRCs and the ROC for SRTP packets it
                transmits.</t>

                <t hangText="MIKEY-RSA"><vspace blankLines="0" />Each endpoint
                indicates a set of SSRCs and the ROC for SRTP packets it
                transmits.</t>

                <t hangText="MIKEY-RSA-R"><vspace blankLines="0" />Each
                endpoint indicates a set of SSRCs and the ROC for SRTP packets
                it transmits.</t>

                <t hangText="MIKEY-DHSIGN"><vspace blankLines="0" />Each
                endpoint indicates a set of SSRCs and the ROC for SRTP packets
                it transmits.</t>

                <t hangText="MIKEY-DHHMAC"><vspace blankLines="0" />Each
                endpoint indicates a set of SSRCs and the ROC for SRTP packets
                it transmits.</t>

                <t hangText="MIKEYv2 in SDP"><vspace blankLines="0" />Each
                endpoint indicates a set of SSRCs and the ROC for SRTP packets
                it transmits.</t>

                <t hangText="Security Descriptions with SIPS"><vspace
                blankLines="0" />Neither SSRC nor ROC are signaled. SSRC 'late
                binding' is used.</t>

                <t hangText="Security Descriptions with S/MIME"><vspace
                blankLines="0" />Neither SSRC nor ROC are signaled. SSRC 'late
                binding' is used.</t>

                <t hangText="SDP-DH"><vspace blankLines="0" />Neither SSRC nor
                ROC are signaled. SSRC 'late binding' is used.</t>

                <t hangText="ZRTP"><vspace blankLines="0" />Neither SSRC nor
                ROC are signaled. SSRC 'late binding' is used.</t>

                <t hangText="EKT"><vspace blankLines="0" />The SSRC of the
                SRTCP packet containing an EKT update corresponds to the SRTP
                master key and other parameters within that packet.</t>

                <t hangText="DTLS-SRTP"><vspace blankLines="0" />Neither SSRC
                nor ROC are signaled. SSRC 'late binding' is used.</t>

                <t hangText="MIKEYv2 Inband"><vspace blankLines="0" />Each
                endpoint indicates a set of SSRCs and the ROC for SRTP packets
                it transmits.</t>
              </list></t>
          </list></t>
      </section>
    </section>

    <section title="Evaluation Criteria - Security">
      <t>This section evaluates each keying mechanism on the basis of their
      security properties.</t>

      <section title="Public Key Infrastructure">
        <t>There are two aspects of PKI requirements -- one aspect is if PKI
        is necessary in order for the mechanism to function at all, the other
        is if PKI is used to authenticate a certificate. With interactive
        communications it is desirable to avoid fetching certificates that
        delay call setup; rather it is preferable to fetch or validate
        certificates in such a way that call setup isn't delayed. For example,
        a certificate can be validated while the phone is ringing or can be
        validated while ring-back tones are being played or even while the
        called party is answering the phone and saying "hello".</t>

        <t hangText="Avoids PKI:">SRTP key exchange mechanisms that require a
        global PKI to operate are gated on the deployment of a common PKI
        available to both endpoints. This means that no media security is
        achievable until such a PKI exists. For SIP, something like <xref
        target="I-D.ietf-sip-certs">sip-certs</xref> might be used to obtain
        the certificate of a peer.</t>

        <t><list>
            <t>Note: Even if SIP CERTs was deployed, the <xref
            target="retargeting">retargeting problem</xref> would still
            prevent successful deployment of keying techniques which require
            the offerer to obtain the actual target's public key.</t>
          </list></t>

        <t>The following list compares the PKI requirements of each keying
        mechanism, both if a PKI is required for the key exchange itself, and
        if PKI is only used to authenticate the certificate supplied in
        signaling.</t>

        <t><list>
            <t><list style="hanging">
                <t hangText="MIKEY-NULL"><vspace blankLines="0" />PKI not
                used.</t>

                <t hangText="MIKEY-PSK"><vspace blankLines="0" />PKI not used;
                rather, all endpoints must have some way to exchange
                per-endpoint or per-system pre-shared keys.</t>

                <t hangText="MIKEY-RSA"><vspace blankLines="0" />The offerer
                obtains the intended answerer's public key before initiating
                the call. This public key is used to encrypt the SRTP keys.
                There is no defined mechanism for the offerer to obtain the
                answerer's public key, although <xref
                target="I-D.ietf-sip-certs"></xref> might be viable in the
                future.</t>

                <t hangText="MIKEY-RSA-R"><vspace blankLines="0" />The offer
                contains the offerer's public key. The answerer uses that
                public key to encrypt the SRTP keys that will be used by the
                offerer and the answerer. A PKI is necessary to validate the
                certificates.</t>

                <t hangText="MIKEY-DHSIGN"><vspace blankLines="0" />PKI is
                used to authenticate the public key that is included in the
                MIKEY message, by walking the CA trust chain.</t>

                <t hangText="MIKEY-DHHMAC"><vspace blankLines="0" />PKI not
                used; rather, all endpoints must have some way to exchange
                per-endpoint or per-system pre-shared keys.</t>

                <t hangText="MIKEYv2 in SDP"><vspace blankLines="0" />The
                behavior will depend on which mode is picked.</t>

                <t hangText="Security Descriptions with SIPS"><vspace
                blankLines="0" />PKI not used.</t>

                <t hangText="Security Descriptions with S/MIME"><vspace
                blankLines="0" />PKI is needed for S/MIME. The offerer must
                obtain the intended target's public key and encrypt their SDP
                with that key. The answerer must obtain the offerer's public
                key and encrypt their SDP with that key.</t>

                <t hangText="SDP-DH"><vspace blankLines="0" />PKI not
                used.</t>

                <t hangText="ZRTP"><vspace blankLines="0" />PKI not used.</t>

                <t hangText="EKT"><vspace blankLines="0" />PKI not used by EKT
                itself, but might be used by the EKT bootstrapping keying
                mechanism (such as certain MIKEY modes).</t>

                <t hangText="DTLS-SRTP"><vspace blankLines="0" />Remote
                party's certificate is sent in media path, and a fingerprint
                of the same certificate is sent in the signaling path.</t>

                <t hangText="MIKEYv2 Inband"><vspace blankLines="0" />The
                behavior will depend on which mode is picked.</t>
              </list></t>
          </list></t>
      </section>

      <section title="Perfect Forward Secrecy">
        <t>In the context of SRTP, Perfect Forward Secrecy is the property
        that SRTP session keys that protected a previous session are not
        compromised if the static keys belonging to the endpoints are
        compromised. That is, if someone were to record your encrypted session
        content and later acquires either party's private key, that encrypted
        session content would be safe from decryption if your key exchange
        mechanism had perfect forward secrecy.</t>

        <t>The following list describes how each key exchange mechanism
        provides PFS.</t>

        <t><list>
            <t><list style="hanging">
                <t hangText="MIKEY-NULL"><vspace blankLines="0" />No PFS.</t>

                <t hangText="MIKEY-PSK"><vspace blankLines="0" />No PFS.</t>

                <t hangText="MIKEY-RSA"><vspace blankLines="0" />No PFS.</t>

                <t hangText="MIKEY-RSA-R"><vspace blankLines="0" />No PFS.</t>

                <t hangText="MIKEY-DHSIGN"><vspace blankLines="0" />PFS is
                provided with the Diffie-Hellman exchange.</t>

                <t hangText="MIKEY-DHHMAC"><vspace blankLines="0" />PFS is
                provided with the Diffie-Hellman exchange.</t>

                <t hangText="MIKEYv2 in SDP"><vspace blankLines="0" />The
                behavior will depend on which mode is picked.</t>

                <t hangText="Security Descriptions with SIPS"><vspace
                blankLines="0" />No PFS.</t>

                <t hangText="Security Descriptions with S/MIME"><vspace
                blankLines="0" />No PFS.</t>

                <t hangText="SDP-DH"><vspace blankLines="0" />PFS is provided
                with the Diffie-Hellman exchange.</t>

                <t hangText="ZRTP"><vspace blankLines="0" />PFS is provided
                with the Diffie-Hellman exchange.</t>

                <t hangText="EKT"><vspace blankLines="0" />No PFS.</t>

                <t hangText="DTLS-SRTP"><vspace blankLines="0" />PFS is
                achieved if the negotiated cipher suite includes an
                exponential or discrete-logarithmic key exchange (such as
                Diffie-Hellman or <xref target="RFC4492">Elliptic Curve
                Diffie-Hellman</xref>).</t>

                <t hangText="MIKEYv2 Inband"><vspace blankLines="0" />The
                behavior will depend on which mode is picked.</t>
              </list></t>
          </list></t>
      </section>

      <section title="Best Effort Encryption">
        <t><vspace blankLines="1" /> <list>
            <t>Note: With the ongoing efforts in <xref
            target="I-D.ietf-mmusic-sdp-capability-negotiation">SDP Capability
            Negotiation</xref>, the conclusions reached in this section may no
            longer be accurate.</t>
          </list> <vspace blankLines="1" /></t>

        <t>With best effort encryption, SRTP is used with endpoints that
        support SRTP, otherwise RTP is used.</t>

        <t>SIP needs a backwards-compatible best effort encryption in order
        for SRTP to work successfully with SIP retargeting and forking when
        there is a mix of forked or retargeted devices that support SRTP and
        don't support SRTP.</t>

        <t><list>
            <t>Consider the case of Bob, with a phone that only does RTP and a
            voice mail system that supports SRTP and RTP. If Alice calls Bob
            with an SRTP offer, Bob's RTP-only phone will reject the media
            stream (with an empty "m=" line) because Bob's phone doesn't
            understand SRTP (RTP/SAVP). Alice's phone will see this rejected
            media stream and may terminate the entire call (BYE) and
            re-initiate the call as RTP-only, or Alice's phone may decide to
            continue with call setup with the SRTP-capable leg (the voice mail
            system). If Alice's phone decided to re-initiate the call as
            RTP-only, and Bob doesn't answer his phone, Alice will then leave
            voice mail using only RTP, rather than SRTP as expected.</t>
          </list>Currently, several techniques are commonly considered as
        candidates to provide opportunistic encryption:</t>

        <t><list style="hanging">
            <t hangText="multipart/alternative"><vspace blankLines="0" />
            <xref target="I-D.jennings-sipping-multipart"></xref> describes
            how to form a multipart/alternative body part in SIP. The
            significant issues with this technique are (1) that multipart MIME
            is incompatible with existing SIP proxies, firewalls, Session
            Border Controllers, and endpoints and (2) when forking, the <xref
            target="I-D.mahy-sipping-herfp-fix">Heterogeneous Error Response
            Forking Problem (HERFP)</xref> causes problems if such
            non-multipart-capable endpoints were involved in the forking.</t>

            <t hangText="SDP Grouping"><vspace blankLines="0" />A new SDP
            grouping mechanism (following the idea introduced in <xref
            target="RFC3388"></xref>) has been discussed which would allow a
            media line to indicate RTP/AVP and another media line to indicate
            RTP/SAVP, allowing non-SRTP-aware endpoints to choose RTP/AVP and
            SRTP-aware endpoints to choose RTP/SAVP. As of this writing, this
            SDP grouping mechanism has not been published as an Internet
            Draft.</t>

            <t hangText="session attribute"><vspace blankLines="0" />With this
            technique, the endpoints signal their desire to do SRTP by
            signaling RTP (RTP/AVP), and using an attribute ("a=") in the SDP.
            This technique is entirely backwards compatible with
            non-SRTP-aware endpoints, but doesn't use the RTP/SAVP protocol
            registered by <xref target="RFC3711">SRTP</xref>.</t>

            <t hangText="Probing"><vspace blankLines="0" />With this
            technique, the endpoints first establish an RTP session using RTP
            (RTP/AVP). The endpoints send probe messages, over the media path,
            to determine if the remote endpoint supports their keying
            technique.</t>
          </list>The following list compares the availability of best effort
        encryption for each keying mechanism.</t>

        <t><list>
            <t><list style="hanging">
                <t hangText="MIKEY-NULL"><vspace blankLines="0" />No best
                effort encryption.</t>

                <t hangText="MIKEY-PSK"><vspace blankLines="0" />No best
                effort encryption.</t>

                <t hangText="MIKEY-RSA"><vspace blankLines="0" />No best
                effort encryption.</t>

                <t hangText="MIKEY-RSA-R"><vspace blankLines="0" />No best
                effort encryption.</t>

                <t hangText="MIKEY-DHSIGN"><vspace blankLines="0" />No best
                effort encryption.</t>

                <t hangText="MIKEY-DHHMAC"><vspace blankLines="0" />No best
                effort encryption.</t>

                <t hangText="MIKEYv2 in SDP"><vspace blankLines="0" />No best
                effort encryption.</t>

                <t hangText="Security Descriptions with SIPS"><vspace
                blankLines="0" />No best effort encryption.</t>

                <t hangText="Security Descriptions with S/MIME"><vspace
                blankLines="0" />No best effort encryption.</t>

                <t hangText="SDP-DH"><vspace blankLines="0" />No best effort
                encryption.</t>

                <t hangText="ZRTP"><vspace blankLines="0" />Best effort
                encryption is done by probing (sending RTP messages with
                header extensions) or by session attribute (see "a=zrtp",
                defined in Section 10 of <xref
                target="I-D.zimmermann-avt-zrtp"></xref>). Current
                implementations of ZRTP use probing.</t>

                <t hangText="EKT"><vspace blankLines="0" />No best effort
                encryption.</t>

                <t hangText="DTLS-SRTP"><vspace blankLines="0" />No best
                effort encryption.</t>

                <t hangText="MIKEY Inband"><vspace blankLines="0" />No best
                effort encryption.</t>
              </list></t>
          </list></t>
      </section>

      <section title="Upgrading Algorithms">
        <t>It is necessary to allow upgrading SRTP encryption and hash
        algorithms, as well as upgrading the cryptographic functions used for
        the key exchange mechanism. With SIP's offer/answer model, this can be
        computionally expensive because the offer needs to contain all
        combinations of the key exchange mechanisms (all MIKEY modes, Security
        Descriptions) and all SRTP cryptographic suites (AES-128, AES-256) and
        all SRTP cryptographic hash functions (SHA-1, SHA-256) that the
        offerer supports. In order to do this, the offerer has to expend CPU
        resources to build an offer containing all of this information which
        becomes computationally prohibitive.</t>

        <t>Thus, it is important to keep the offerer's CPU impact fixed so
        that offering multiple new SRTP encryption and hash functions incurs
        no additional expense.</t>

        <t>The following list describes the CPU effort involved in using each
        key exchange technique.</t>

        <t><list>
            <t><list style="hanging">
                <t hangText="MIKEY-NULL"><vspace blankLines="0" />No
                significant computaional expense.</t>

                <t hangText="MIKEY-PSK"><vspace blankLines="0" />No
                significant computational expense.</t>

                <t hangText="MIKEY-RSA"><vspace blankLines="0" />For each
                offered SRTP crypto suite, the offerer has to perform RSA
                operation to encrypt the TGK</t>

                <t hangText="MIKEY-RSA-R"><vspace blankLines="0" />For each
                offered SRTP crypto suite, the offerer has to perform public
                key operation to sign the MIKEY message.</t>

                <t hangText="MIKEY-DHSIGN"><vspace blankLines="0" />For each
                offered SRTP crypto suite, the offerer has to perform
                Diffie-Hellman operation, and a public key operation to sign
                the Diffie-Hellman output.</t>

                <t hangText="MIKEY-DHHMAC"><vspace blankLines="0" />For each
                offered SRTP crypto suite, the offerer has to perform
                Diffie-Hellman operation.</t>

                <t hangText="MIKEYv2 in SDP"><vspace blankLines="0" />The
                behavior will depend on which mode is picked.</t>

                <t hangText="Security Descriptions with SIPS"><vspace
                blankLines="0" />No significant computational expense.</t>

                <t hangText="Security Descriptions with S/MIME"><vspace
                blankLines="0" />S/MIME requires the offerer and the answerer
                to encrypt the SDP with the other's public key, and to decrypt
                the received SDP with their own private key.</t>

                <t hangText="SDP-DH"><vspace blankLines="0" />For each offered
                SRTP crypto suite, the offerer has to perform a Diffie-Hellman
                operation.</t>

                <t hangText="ZRTP"><vspace blankLines="0" />The offerer has no
                additional computational expense at all, as the offer contains
                no information about ZRTP or might contain "a=zrtp".</t>

                <t hangText="EKT"><vspace blankLines="0" />The offerer's
                Computational expense depends entirely on the EKT
                bootstrapping mechanism selected (one or more MIKEY modes or
                Security Descriptions).</t>

                <t hangText="DTLS-SRTP"><vspace blankLines="0" />The offerer
                has no additional computational expense at all, as the offer
                contains only a fingerprint of the certificate that will be
                presented in the DTLS exchange.</t>

                <t hangText="MIKEYv2 Inband"><vspace blankLines="0" />The
                behavior will depend on which mode is picked.</t>
              </list></t>
          </list></t>
      </section>
    </section>

    <section anchor="ofs" title="Out-of-Scope">
      <t>Discussions concluded that key management for shared-key encryption
      of conferencing is outside the scope of this document. As the priority
      is point-to-point unicast SRTP session keying, resolving shared-key SRTP
      session keying is deferred to later and left as an item for future
      investigations.</t>
    </section>
  </back>
</rfc>

PAFTECH AB 2003-20262026-04-23 23:11:13