Subject: How are authenticated sessions described using SDP?

From: Ross Finlayson <[email-masked]>
Date: Wed, 06 Sep 2000 02:31:45 -0700

Is there any consensus on how authenticated media sessions - i.e., sessions 
that have an associated authentication key - are described using SDP?  The 
current SDP spec says how to describe an *encryption* key, but not an 
*authentication* key.  (Note that I'm referring not to authentication of 
the SDP announcement (e.g., in SAP), but rather to authentication that 
would be applied to packets that are sent within the session itself.)

For typical media (audio, video, etc.), this is probably somewhat of a moot 
question right now, because I don't think we yet have an agreed-upon way of 
applying authentication (e.g., using digital signatures, cryptographic 
hashes, etc.) to RTP/RTCP sessions.  (This is something that will arise as 
a result of the secure multicast research group, right?)  But the reason I 
raise this question now is that someone recently asked me how 
authentication for *directory* sessions could be represented in SDP.  For 
directory sessions we do, indeed, have an idea how authentication would 
work - namely, the recent proposal for authenticated SAP.

	Ross.

---

From: Michael Thomas <[email-masked]>
Date: Wed, 6 Sep 2000 08:41:44 -0700 (PDT)

The main problem is not with SDP, but with RTP
which doesn't specify any means of placing an HMAC
on a RTP packet.

	 Mike

---

From: Ross Finlayson <[email-masked]>
Date: Thu, 07 Sep 2000 14:52:36 -0700

>which doesn't specify any means of placing an HMAC

Well, maybe, but - as I pointed out in my original message - there are 
session types other than RTP/AVP for which authentication mechanisms have 
already been defined.  So it's worthwhile for us to be thinking about how 
to denote authentication in SDP, even though RTP sessions can't yet make 
use of this.

         Ross.