Re: Additional use cases? (Re: Plan for moving forward)

[Eric Rescorla <ekr@xxxxxxxxxxxxxxxxxxxx>]

At Wed, 06 Jun 2007 22:41:34 -0700,
Lakshminath Dondeti wrote:
> I guess I talked about the generic case a few times, so let's start with 
> an example.  Consider the use case of using calling cards
> 
> Alice is a SIP Phone, and Uma wants to use it to make a call to Bob 
> (Calling card Server).
> 
> Case 1: Uma registers Alice as an authorized phone with Bob.  The 
> current model of DTLS-SRTP works (although it reverses the client-server 
> relationship).

Why does this reverse the client-server relationship?

1. DTLS-SRTP requires that both sides have certificates, but EITHER
side can have a self-signed cert or a third-party cert. This is true
no matter which side is client or server. 

2. The client-server relationship in DTLS-SRTP is actually independent
of who is the caller. It's controlled by passive/active attributes
in the SDP. In general, it's attractive for the answerer to be the
client, purely for the performance reason that if you're not using
ICE you want the ClientHello to be sent immediately to minimize RTTs.
[With ICE, the performance issues are more complicated and depend
on which side is controlling and whether you are doing aggressive
or regular nomination].


> Case 2: Alice is any SIP Phone and Uma makes a call using it.  Uma may 
> accept Bob's identity asserted through the SIP infrastructure, but wants 
> to authenticate via a secure channel established with Bob authenticated 
> and Uma will authenticate by sending calling card information (username, 
> password, or just password) as DTMF tones in the media path.  (Note: Uma 
> may not necessarily trust Bob's identity asserted through the SIP 
> infrastructure.)
>
> Case 3: Bob's identity is asserted in the media path and Uma enters the 
> calling card information as DTMF tones in the media path.
>
> In other contexts, the terms user-identity and device-identity have also 
> been used.
> 
> Note that priority call placement use case is similar.

I don't understand why you think that any of these cases presents
a problem. 

You just do the ordinary SIP-Identity + DTLS-SRTP handshake,
which are all about protecting the signalling channel and binding
it to the media and then you pass the DTMF or whatever in the
media. This works fine.

-Ekr