Re: [rtcweb] BUNDLE: Attempting to resolve security consideration

On Mon, Mar 6, 2017 at 5:35 AM, Iñaki Baz Castillo <[email protected]> wrote:

> 2017-03-03 14:24 GMT+01:00 Magnus Westerlund <
> [email protected]>:
> > When the BUNDLE extension is used, the number of SSRC values within a
> single RTP session increases, which increases the risk of SSRC collision
>
> This is relevant when there are ~100000000 streams within a single RTP
> session. If there are 10 streams, the exact risk is 10 / 2^32 =
> 2.32e-09.
>

This actually isn't quite correct (this is just the usual birthday paradox
math)
Assuming I haven't made a mistake, the correct formula is:

1 - (\prod_{i=0}^{9} 2^{32} - i)


I think we can live without having to mention this "issue" in every
> RTP related specification.
>

I agree with you that this is a relatively small number, but that doesn't
mean we don't
need to consider it. For instance, if SRTP did not use directional keys and
we allowed
each side to choose SSRCs w/o any attempts to suppress collisions, there
would
be a small but non-zero number of calls which used a two-time pad on a
daily basis.

-Ekr


>
> To be clear: stating that "BUNDLE increases the risk of SSRC
> collision" is a no sense IMHO.
>
>
>
>
> --
> Iñaki Baz Castillo
> <[email protected]>
>
> _______________________________________________
> rtcweb mailing list
> [email protected]
> https://www.ietf.org/mailman/listinfo/rtcweb
>

_______________________________________________
mmusic mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/mmusic