Re: draft-dtls-sdp: Allow offerer to establish DTLS association before it has received the SDP answer?
Cullen Jennings <[email protected]>
| Newsgroups | gmane.ietf.mmusic |
|---|---|
| Message-ID | <[email protected]> |
> On May 16, 2017, at 12:43 AM, Christer Holmberg <[email protected]> wrote: > > The pull request based on the WGLC comments from Roman S and Martin T, > suggests text saying that if an offerer receives ClientHello it must not > send ServerHello until it has received the answer (that carries the > fingerprint associated with the DTLS association). I strongly disagree with adding this at this level. Consider for example an endpoint that does not do ICE. Will you also wait until the identity checks are complete to check that the fingerprint is valid and not inserted by a MITM? That might make sense for WebRTC but it is something specified at a much higher system level than here. This should just be a building block that allows systems to use dtls-sdp as they see fit instead of trying to mandate how it will be used at a higher level.