Best Practices for Securing RTP Media Signaled with SIP
draft-ietf-sipbrandy-rtpsec-08

Document Type Active Internet-Draft (sipbrandy WG)
Last updated 2019-08-16 (latest revision 2019-04-25)
Replaces draft-peterson-sipbrandy-rtpsec
Stream IETF
Intended RFC status Best Current Practice
Formats plain text pdf htmlized bibtex
Reviews
Stream WG state Submitted to IESG for Publication
Document shepherd Gonzalo Camarillo
Shepherd write-up Show (last changed 2018-10-30)
IESG IESG state RFC Ed Queue
Consensus Boilerplate Yes
Telechat date
Responsible AD Alexey Melnikov
Send notices to Gonzalo Camarillo <gonzalo.camarillo@ericsson.com>
IANA IANA review state Version Changed - Review Needed
IANA action state RFC-Ed-Ack
RFC Editor RFC Editor state EDIT
Network Working Group                                        J. Peterson
Internet-Draft                                                   Neustar
Intended status: Best Current Practice                         R. Barnes
Expires: October 27, 2019                                          Cisco
                                                              R. Housley
                                                          Vigil Security
                                                          April 25, 2019

        Best Practices for Securing RTP Media Signaled with SIP
                     draft-ietf-sipbrandy-rtpsec-08

Abstract

   Although the Session Initiation Protocol (SIP) includes a suite of
   security services that has been expanded by numerous specifications
   over the years, there is no single place that explains how to use SIP
   to establish confidential media sessions.  Additionally, existing
   mechanisms have some feature gaps that need to be identified and
   resolved in order for them to address the pervasive monitoring threat
   model.  This specification describes best practices for negotiating
   confidential media with SIP, including a comprehensive protection
   solution that binds the media layer to SIP layer identities.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on October 27, 2019.

Copyright Notice

   Copyright (c) 2019 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents

Peterson, et al.        Expires October 27, 2019                [Page 1]
Internet-Draft                RTP Security                    April 2019

   (https://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   3
   3.  Security at the SIP and SDP layer . . . . . . . . . . . . . .   3
   4.  STIR Profile for Endpoint Authentication and Verification
       Services  . . . . . . . . . . . . . . . . . . . . . . . . . .   4
     4.1.  Credentials . . . . . . . . . . . . . . . . . . . . . . .   5
     4.2.  Anonymous Communications  . . . . . . . . . . . . . . . .   6
     4.3.  Connected Identity Usage  . . . . . . . . . . . . . . . .   7
     4.4.  Authorization Decisions . . . . . . . . . . . . . . . . .   8
   5.  Media Security Protocols  . . . . . . . . . . . . . . . . . .   8
   6.  Relayed Media and Conferencing  . . . . . . . . . . . . . . .   9
   7.  ICE and Connected Identity  . . . . . . . . . . . . . . . . .   9
   8.  Best Current Practices  . . . . . . . . . . . . . . . . . . .  10
   9.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .  10
   10. Security Considerations . . . . . . . . . . . . . . . . . . .  11
   11. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . .  11
   12. References  . . . . . . . . . . . . . . . . . . . . . . . . .  11
     12.1.  Normative References . . . . . . . . . . . . . . . . . .  11
     12.2.  Informative References . . . . . . . . . . . . . . . . .  13
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  14

1.  Introduction

   The Session Initiation Protocol (SIP) [RFC3261] includes a suite of
   security services, including Digest authentication, for
   authenticating entities with a shared secret, TLS for transport
   security, and S/MIME (optionally) for body security.  SIP is
   frequently used to establish media sessions, in particular audio or
   audiovisual sessions, which have their own security mechanisms
   available, such as Secure RTP [RFC3711].  However, the practices
   needed to bind security at the media layer to security at the SIP
   layer, to provide an assurance that protection is in place all the
   way up the stack, rely on a great many external security mechanisms
Show full document text