Subject: [MSEC] Mixing Session Level and Media Level a=key-mgmt:mikey lines

From: "Christian Beaulieu" <[email-masked]>
Date: Fri, 17 Feb 2006 09:06:44 -0500

From: Guylain Lavoie 

Hi everyone,

I have two questions related to the utilization of MIKEY with SDP.

As stated in draft-ietf-mmusic-kmgmt-ext-15.txt, a single SRTP media
stream generates two MIKEY crypto sessions. The first is outgoing and
includes the locally known outgoing SSRC and ROC. The second is incoming
and includes zeroed SSRC and ROC since they are not known. The MIKEY
responder will later provide them in its MIKEY response.

Now that being said, if a=key-mgmt:mikey line is located at the session
level and there are two m= lines, the session level MIKEY exchange will
contain four crypto sessions. Two for each of the SRTP streams. Here is
the example.

   v=0

   o=alice 2891092738 2891092738 IN IP4 w-land.example.com

   s=Cool stuff

   e=[email-masked]

   t=0 0

   c=IN IP4 w-land.example.com

   a=key-mgmt:mikey AQAFgM0XflABZZZZZZZZZZZZZZZZZAy... <== 4 CS

   m=audio 49000 RTP/SAVP 98

   a=rtpmap:98 AMR/8000

   m=video 52230 RTP/AVP 31

   a=rtpmap:31 H261/90000

draft-ietf-mmusic-kmgmt-ext-15.txt also states that if a key-mgmt
attribute exists at the media level, the session level attribute MUST be
ignored.

Now, this puzzles me. If we reuse the previous example but with a single
modification. If one of the media level also contains a a=key-mgmt:mikey
line. How many crypto sessions will now be created within the session
level MIKEY initiate message? Four or Two? Four for both media lines
even if the first one also contains a a=key-mgmt:mikey line or two, only
for the second media line.

For example,

   v=0

   o=alice 2891092738 2891092738 IN IP4 w-land.example.com

   s=Cool stuff

   e=[email-masked]

   t=0 0

   c=IN IP4 w-land.example.com

   a=key-mgmt:mikey AQAFgM0XflABZZZZZZZZZZZZZZZZZAy... <== 4 or 2 CS?

   m=audio 49000 RTP/SAVP 98

   a=rtpmap:98 AMR/8000

   a=key-mgmt:mikey AQAFgM0XflABAAAAAAAAAAAAAAsAy... <== 2 CS

   m=video 52230 RTP/AVP 31

   a=rtpmap:31 H261/90000

My second question is "What should we do if the media level MIKEY
exchange fails while the session level MIKE exchanges is successful?".
draft-ietf-mmusic-kmgmt-ext-15.txt says that the session level must be
ignored. I assume that if the media level MIKEY exchange fails, then
there will be no automatic fallback to the session level MIKEY exchange
event if the answer to the first question is four. If the answer was
two, then it becomes obvious that there is no fallback. I would expect
that no fallback is possible (in all cases).

Best Regards,

Guylain Lavoie

_______________________________________________
msec mailing list
[email-masked]
http://six.pairlist.net/mailman/listinfo/msec