At Wed, 06 Jun 2007 22:41:34 -0700,
Lakshminath Dondeti wrote:
I guess I talked about the generic case a few times, so let's start with
an example. Consider the use case of using calling cards
Alice is a SIP Phone, and Uma wants to use it to make a call to Bob
(Calling card Server).
Case 1: Uma registers Alice as an authorized phone with Bob. The
current model of DTLS-SRTP works (although it reverses the client-server
relationship).
Why does this reverse the client-server relationship?
1. DTLS-SRTP requires that both sides have certificates, but EITHER
side can have a self-signed cert or a third-party cert. This is true
no matter which side is client or server.
2. The client-server relationship in DTLS-SRTP is actually independent
of who is the caller. It's controlled by passive/active attributes
in the SDP. In general, it's attractive for the answerer to be the
client, purely for the performance reason that if you're not using
ICE you want the ClientHello to be sent immediately to minimize RTTs.
[With ICE, the performance issues are more complicated and depend
on which side is controlling and whether you are doing aggressive
or regular nomination].
Case 2: Alice is any SIP Phone and Uma makes a call using it. Uma may
accept Bob's identity asserted through the SIP infrastructure, but wants
to authenticate via a secure channel established with Bob authenticated
and Uma will authenticate by sending calling card information (username,
password, or just password) as DTMF tones in the media path. (Note: Uma
may not necessarily trust Bob's identity asserted through the SIP
infrastructure.)
Case 3: Bob's identity is asserted in the media path and Uma enters the
calling card information as DTMF tones in the media path.
In other contexts, the terms user-identity and device-identity have also
been used.
Note that priority call placement use case is similar.
I don't understand why you think that any of these cases presents
a problem.
You just do the ordinary SIP-Identity + DTLS-SRTP handshake,
which are all about protecting the signalling channel and binding
it to the media and then you pass the DTMF or whatever in the
media. This works fine.
-Ekr