Subject: RE: RTSP denial-of-service attacks: never mind

From: Rob Lanphier <[email-masked]>
Date: Thu, 24 Apr 1997 09:25:53 -0700

At 01:48 PM 4/24/97 +0300, Sampo Syreeni wrote:
>On Wed, 23 Apr 1997, Eric Fleischman wrote:
>>There seems to be general concurrence that this is a serious concern and
>>that the proper solution is to require authentication. What isn't clear
>>to me is how the RTSP community wishes to respond to this. Two obvious
>>possibilities are:
>>
>>1) to purposefully not add this capability to RTSP until/unless an
>>authentication mechanism is defined for it.
>
>So do you suggest a dedicated authentication mechanism for RTSP? It might
>be that a general purpose authentication protocol could be a better
>candidate. For the sake of modularity and orthogonality in the overall
>protocol suite, maybe the authentication part should be left for the
>server and the potential receiver to do, out of band. (I'm not an expert
>on the current state of authentication protocols but they're bound to be
>out there. I also remember that this has been suggested already. So I
>support it.)

Not only this, but shoehorning everyone into a single mechanism isn't
necessarily going to be appropriate.  In some cases, you may want to get as
intricate as a PGP authenticated handshake between the RTSP client and the
RTP recipient when they are different.  In other cases (i.e. intranets),
simply specifying an IP range or an xhost style list may be the appropriate
"protocol".

In fact, typing "man Xsecurity" on your local X-windows box actually
provides a good starting place for discussion on this.  Not that I'm
advocating handling this exactly like they did, but we're trying to solve a
very similar problem here, and the prior experience may be a good
foundation for this.

Rob

---
Rob Lanphier               Voice: (206)674-2322         Fax: (206)674-2699
Program Manager-Protocols                         Email: [email-masked]
Progressive Networks-Home of RealAudio            Web: http://www.real.com
For more information on firewalls:       http://www.real.com/firewall.html
For more information on RTSP:               http://www.real.com/prognet/rt

---

From: Eric Fleischman <[email-masked]>
Date: Fri, 25 Apr 1997 09:05:28 -0700

I would prefer a generic authentication mechanism, preferably one
pattered after HTTP. Unfortunately, when I last looked into the HTTP
mechanisms (November 1996), there were no adequately secure, generic
HTTP authentication alternatives available. (Or at least, I failed to
find one. There were several proprietary alternatives available.)

Your idea of getting the server and nominated third parties to negotiate
is a clever one. I personally don't know how to pursue it without
defining a unique solution for RTSP. That would be a bad thing to do
since we need to use common generic, approaches so that our security
approach could advance as the security industry advances.

I have sent a query to the Common Authentication Technology (CAT) WG to
see what type of sage advice they may care to offer us.

> -----Original Message-----
> From:	Sampo Syreeni [SMTP:[email-masked]]
> Sent:	Thursday, April 24, 1997 3:49 AM
> To:	Eric Fleischman
> Cc:	'Anup Rao'; Henning Schulzrinne; [email-masked]
> Subject:	RE: RTSP denial-of-service attacks: never mind
> 
> >My 2 cents worth: The only problem I have with alternative 2 is that
> I
> >fear that it may not result in the same authentication method being
> used
> >by all RTSP implementations.
> 
> Yep. It's bargaining with the devil...
> 
> Sampo Syreeni (Decoy/dAWN), student, <[email-masked]>

---

From: Pete Cordell <[email-masked]>
Date: Wed, 30 Apr 1997 19:37:08 +0100

If this is forming the basis of a vote, then I agree with Henning,
assuming that he is saying that option 2 is the right way to go!

After all, black marks on a piece of paper won't stop somebody doing
something if it's what they want to do and it's easy!!!

Pete

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Pete Cordell
BT Labs
E-Mail: [email-masked]
Tel: +44 1473 646436
Fax: +44 1473 643791
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

>----------
>From: 	Henning Schulzrinne[SMTP:[email-masked]]
>Sent: 	24 April 1997 01:29
>To: 	Eric Fleischman
>Cc: 	[email-masked]
>Subject: 	Re: RTSP denial-of-service attacks: never mind
>
>Eric Fleischman wrote:
>> 
>Certainly, in some environments (intranets), this seems overly
>conservative. Plus, it's needed (or at least very useful) for multicast
>destinations and all it takes is one marketing guy saying that a
>customer wants it for unicast and some server will implement it...
>
>> 
>> 2) to add this capability to RTSP but to do so with warning messages
>> that it probably shouldn't be implemented until such a time as an
>> authentication mechanism is defined.
>
>RTSP inherits two authentication mechanisms from HTTP: Basic and
>Digest.
>It may also use SSL for client and server authentication; just added
>the
>URL type rtsps:// for RTSP over SSL to the draft (before I forget...).
>Servers SHOULD support Basic and Digest authentication (i.e., they are
>only conditionally compliant if they do not).
>
>> 
>> Does this summary represent the consensus of our community?
>> Which alternative does the community feel is preferential?
>>

Notice:  This contribution is the personal view of the author and 
does not necessarily reflect the technical nor commercial direction 
of British telecommunications plc.
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx