Subject: Encrypted SAP packets

From: Steve Hanna <[email-masked]>
Date: Fri, 1 Aug 1997 15:51:11 -0400 (EDT)

The new draft on SAP security (draft-ietf-mmusic-sap-sec-01.txt) raised the 
following question for me.

If the announcement for a particular session is encrypted, how will others (who 
can't decode the announcement) know that they shouldn't use the multicast 
address during that period? In other words, isn't the address allocation feature 
of SAP negated by encrypting session announcements?

Should we recommend that an additional unencrypted session announcement with 
minimal information other than the multicast address be sent as well? I suppose 
that this applies to the basic SAP draft as well, if its encryption features are 
used.

I probably won't be able to access email starting about an hour from now and 
running until after IETF. My colleague, Miriam Kadansky, will monitor any 
responses in my absence.

Steve Hanna
Sun Microsystems, Inc.

---

From: "Peter T. Kirstein" <[email-masked]>
Date: Mon, 04 Aug 1997 08:57:59 +0100

>that this applies to the basic SAP draft as well, if its encryption
features are 

I agree this is a problem. I think this is better addressed in the basic SAP
draft, and that some of this information might be repeated outside the part
which will be encrypted. There is a question which worries many on how much
information about the multicast address and the times it is used should be
given; this encourages concerted hacking attempts, of course.