Subject: [Ice] 5245bis: Discarding low-priority candidates

From: Christer Holmberg <[email-masked]>
Date: Thu, 3 Nov 2016 18:17:37 +0000

Hi,

Section 5.1.3.3 (Pruning the Pairs) of 5245bis contains the following paragraph:

   "In addition, in order to limit the attacks described in
  Section 13.4.1, an agent MUST limit the total number of connectivity
   checks the agent performs across all check lists to a specific value,
   and this value MUST be configurable.  A default of 100 is
   RECOMMENDED.  This limit is enforced by discarding the lower-priority
   candidate pairs until there are less than 100.  It is RECOMMENDED
   that a lower value be utilized when possible, set to the maximum
   number of plausible checks that might be seen in an actual deployment
   configuration.  The requirement for configuration is meant to provide
   a tool for fixing this value in the field if, once deployed, it is
   found to be problematic."

I guess we can have some text about removing low-priority candidate pairs, but do we really need a number? And, if we need a number, do we need to take into consideration multiple ICE instances (e.g., multiple browser tabs)?

Also, is removing low-priority candidates really part of pruning? Elsewhere in the document where pruning is mentioned there is no word about removing low-priority candidates. So, if we want to keep the text (or a modified version of it), perhaps it should be a separate section?

Regards,

Christer

---

From: Nils Ohlmeier <[email-masked]>
Date: Tue, 15 Nov 2016 16:26:26 -0800

Hi,

> On Nov 3, 2016, at 11:17, Christer Holmberg <[email-masked]> wrote:
>    “In addition, in order to limit the attacks described in
>    found to be problematic.”
>  
> I guess we can have some text about removing low-priority candidate pairs, but do we really need a number?

The number appears to be taken from section 14.4.1. If there is no number provided I think should suggest some heuristic to calculate such a number. But I have no real idea how such a heuristic could look like.

> And, if we need a number, do we need to take into consideration multiple ICE instances (e.g., multiple browser tabs)?

That appears to assume that the ICE implementation is shared across multiple browser tabs, which could be the case or not.
 
> Also, is removing low-priority candidates really part of pruning? Elsewhere in the document where pruning is mentioned there is no word about removing low-priority candidates. So, if we want to kee…

To me pruning and this security measure are two different things. Pruning is basically removing duplicates.
I think a separate section would be appropriate.

Best
  Nils Ohlmeier