Subject: RE: Encrypted SAP packets

From: Arlie Davis <[email-masked]>
Date: Mon, 4 Aug 1997 02:56:05 -0700

> -----Original Message-----
> From:	Peter T. Kirstein [SMTP:[email-masked]]
> Sent:	Monday, August 04, 1997 12:58 AM
> To:	Steve Hanna
> Cc:	[email-masked]; [email-masked]
> Subject:	Re: Encrypted SAP packets
> 
> I agree this is a problem. I think this is better addressed in the
> basic SAP
> draft, and that some of this information might be repeated outside the
> part
> which will be encrypted. There is a question which worries many on how
> much
> information about the multicast address and the times it is used
> should be
> given; this encourages concerted hacking attempts, of course.
> 
Learning the multicast address from an SDP description is no different
than learning it from watching what comes down a pipe.  The only
interesting information in the encrypted SDP header would be the address
of the machine originating the session announcement; this can be learned
from watching what is being transmitted, anyway.

If your application can't stand up to "concerted hacking attempts," why
bother transmitting to begin with?  Why else do we even bother
encrypting traffic?

-- arlie

---

From: Peter KIRSTEIN <[email-masked]>
Date: Mon, 04 Aug 1997 13:42:03 +0100

>bother transmitting to begin with?  Why else do we even bother
Let me be clear; I am not worried about having multicast addresses and
times in the clear; I am quite happy about putting information like
encryption key ID in the clear too. Others are much more worried aobut
this, and it is something that we should discuss in the IETF MMUSIC
meeting.

Peter Kirstein