Subject: [dispatch] New proposal do declare SDP Security Descriptions (RFC4568) Historic

From: Magnus Westerlund <[email-masked]>
Date: Mon, 12 Jul 2021 12:14:21 +0000

Hi,

John and I have a draft that proposes that RFC 4568 (Session
Description Protocol (SDP) Security Descriptions for Media
Streams) should be declared Historic. As the draft explains the
security level SDP Security Description provide is not on the level on
could expected by an IETF in force proposed standard and there exist
alternatives.  

We currently point this draft to Dispatch as we are a bit uncertain if
this should be handled in MMUSIC WG or somewhere else? 
Therefore we proposes that this draft is discussed on the dispatch list
until dispatched. 

Cheers

Magnus Westerlund

Name:           draft-mattsson-dispatch-sdes-dont-dont-dont
Revision:       00
Title:          SDP Security Descriptions is NOT RECOMMENDED and
Historic
Document date:  2021-07-12
Group:          Individual Submission
Pages:          8
URL:            
https://www.ietf.org/archive/id/draft-mattsson-dispatch-sdes-dont-dont-dont-00.txt
Status:         
https://datatracker.ietf.org/doc/draft-mattsson-dispatch-sdes-dont-dont-dont/
Htmlized:       
https://datatracker.ietf.org/doc/html/draft-mattsson-dispatch-sdes-dont-dont-dont

Abstract:
   Key exchange without forward secrecy enables pervasive monitoring.
   Massive pervasive monitoring attacks relying on key exchange without
   forward secrecy have been reported, and many more have likely
   happened without ever being reported.  If key exchange without
   Diffie-Hellman is used, access to long-term keys enable passive
   attackers to compromise past and future sessions.  Entities can get
   access to long-term key material in different ways: physical
attacks,
   hacking, social engineering attacks, espionage, or by simply
   demanding access to keying material with or without a court order.
   Session Description Protocol (SDP) Security Descriptions (RFC 4568)
   does not offer PFS and has a large number of additional significant
   security weaknesses.  This document specifies that use of the SDP
   Security Descriptions is NOT RECOMMENDED.  New deployments SHOULD
   forbid support of SDP Security Descriptions.

   This document reclassifies RFC 4568 (SDP Security Descriptions) to
   Historic Status and also obsoletes RFC 4568.

   This document updates RFC 7201 (Options for Securing RTP Sessions)
to
   note that SDP Security Descriptions SHOULD NOT be used.

---

From: Ted Hardie <[email-masked]>
Date: Mon, 12 Jul 2021 14:01:51 +0100

Hi Magnus,

This seems like a reasonable work item for MMUSIC to me (and a reasonable
goal as well).

regards

Ted

On Mon, Jul 12, 2021 at 1:15 PM Magnus Westerlund <magnus.westerlund=
[email-masked]> wrote:

> Hi,
>
> John and I have a draft that proposes that RFC 4568 (*Session Description
> Protocol (SDP) Security Descriptions for Media Streams)* should be
> declared Historic. As the draft explains the security level SDP Security
> Description provide is not on the level on could expected by an IETF in
> force proposed standard and there exist alternatives.
>
> Title:          SDP Security Descriptions is NOT RECOMMENDED and Historic
>    access to long-term key material in different ways: physical attacks,
>    This document updates RFC 7201 (Options for Securing RTP Sessions) to
> _______________________________________________
> dispatch mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dispatch
>