Subject: Authentication in RTSP

From: Eric Fleischman <[email-masked]>
Date: Fri, 25 Apr 1997 08:57:57 -0700

This query is to the Common Authentication Technology working group
asking for some sage advice about authentication protocols.

The MMUSIC working group is currently working on the RealTime Streaming
Protocol (RTSP). RTSP is a protocol which is explicitly being pattered
after HTTP. The goal of RTSP is to stream multimedia content (e.g.,
audio, video, still images, etc.). One of our desired RTSP features is a
to be able to permit an individual to indicate an IP address of a third
party (that address may be unicast or multicast address) to receive a
multimedia stream. It is conceivable that multiple third party addresses
may be so indicated. We would like to specify one or more currently
available, fairly powerful, generic authentication mechanisms by which
we can identify the client making the request to seek to avoid denial of
service attacks and other similar problems.

Questions:
1) Is access control also a concern we need to worry about (i.e., a
mechanism to determine whether the client requester has the authority to
identify third party addresses to receive multimedia streams)?? If so,
how would we do this?

2) Are any commonly available HTTP authentication mechanisms adequate
for our task (e.g., BASIC authentication sends the password in the clear
over the wire so that would be a bad choice. Is there a more adequate
choice available?) ?

3) What sage advice/wisdom could you give us about authentication
mechanisms/approaches? 

Many thanks.