Subject: RE: [SIP] Is SDP sufficient? (to identify RTP sources)

From: Christian Huitema <[email-masked]>
Date: Wed, 12 Jul 2000 13:17:13 -0700

> --> Doug Sauder writes:
> >
> >I have been thinking through some issues associated with RTP 
> streams and
> >security in the context of two party calls.  The main issue 
> is, How can the
> >RTP receiver filter the incoming RTP packets in a way that 
> guarantees -- or
> >at least provides reasonable assurance -- that those packets 
> come from the
> >other party to the call?  The SDP that comes as part of a 
> SIP message tells
> >the IP address and UDP port of a receiver, but not of a sender.

The short answer is, if you want security, use encryption. Send the key, or
a pointer on how to build the key, in the original SDP.  Messages that are
encrypted with that key come from an authorized source; other messages may
be forged.

Checking the IP source address is always a questionable idea. It does not
bring you real security, since addresses can be spoofed, and it creates lots
of operational problems with multi-homed hosts and mobile hosts. In
addition, you will observe that any attempt to check the IP source creates a
race condition between the arrival of the RTP packets and the completion of
the initial SIP transaction.

Christian Huitema

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip