DTLS Tunnel between a Media Distributor and Key Distributor to Facilitate Key Exchange

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 16 May 2022.¶

Copyright Notice

Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.¶

Table of Contents

1. Introduction

An objective of Privacy-Enhanced RTP Conferencing (PERC) [RFC8871] is to ensure that endpoints in a multimedia conference have access to the end-to-end (E2E) and hop-by-hop (HBH) keying material used to encrypt and authenticate Real-time Transport Protocol (RTP) [RFC3550] packets, while the Media Distributor has access only to the HBH keying material for encryption and authentication.¶

This specification defines a tunneling protocol that enables the Media Distributor to tunnel DTLS [I-D.ietf-tls-dtls13] messages between an endpoint and a Key Distributor, thus allowing an endpoint to use DTLS-SRTP [RFC5764] for establishing encryption and authentication keys with the Key Distributor.¶

The tunnel established between the Media Distributor and Key Distributor is a TLS [RFC8446] connection that is established before any messages are forwarded by the Media Distributor on behalf of endpoints. DTLS packets received from an endpoint are encapsulated by the Media Distributor inside this tunnel as data to be sent to the Key Distributor. Likewise, when the Media Distributor receives data from the Key Distributor over the tunnel, it extracts the DTLS message inside and forwards the DTLS message to the endpoint. In this way, the DTLS association for the DTLS-SRTP procedures is established between an endpoint and the Key Distributor, with the Media Distributor forwarding DTLS messages between the two entities via the established tunnel to the Key Distributor and having no visibility into the confidential information exchanged.¶

Following the existing DTLS-SRTP procedures, the endpoint and Key Distributor will arrive at a selected cipher and keying material, which are used for HBH encryption and authentication by both the endpoint and the Media Distributor. However, since the Media Distributor would not have direct access to this information, the Key Distributor explicitly shares the HBH key information with the Media Distributor via the tunneling protocol defined in this document. Additionally, the endpoint and Key Distributor will agree on a cipher for E2E encryption and authentication. The Key Distributor will transmit keying material to the endpoint for E2E operations, but will not share that information with the Media Distributor.¶

By establishing this TLS tunnel between the Media Distributor and Key Distributor and implementing the protocol defined in this document, it is possible for the Media Distributor to facilitate the establishment of a secure DTLS association between an endpoint and the Key Distributor in order for the endpoint to generate E2E and HBH keying material. At the same time, the Key Distributor can securely provide the HBH keying material to the Media Distributor.¶

2. Conventions Used In This Document

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

This document uses the terms "endpoint", "Media Distributor", and "Key Distributor" defined in [RFC8871].¶

3. Tunneling Concept

A TLS connection (tunnel) is established between the Media Distributor and the Key Distributor. This tunnel is used to relay DTLS messages between the endpoint and Key Distributor, as depicted in Figure 1:¶

                         +-------------+
                         |     Key     |
                         | Distributor |
                         +-------------+
                             # ^ ^ #
                             # | | # <-- TLS Tunnel
                             # | | #
+----------+             +-------------+             +----------+
|          |     DTLS    |             |    DTLS     |          |
| Endpoint |<------------|    Media    |------------>| Endpoint |
|          |    to Key   | Distributor |   to Key    |          |
|          | Distributor |             | Distributor |          |
+----------+             +-------------+             +----------+

The three entities involved in this communication flow are the endpoint, the Media Distributor, and the Key Distributor. The behavior of each entity is described in Section 5.¶

The Key Distributor is a logical function that might be co-resident with a key management server operated by an enterprise, reside in one of the endpoints participating in the conference, or elsewhere that is trusted with E2E keying material.¶

4. Example Message Flows

This section provides an example message flow to help clarify the procedures described later in this document. It is necessary that the Key Distributor and Media Distributor establish a mutually authenticated TLS connection for the purpose of sending tunneled messages, though the complete TLS handshake for the tunnel is not shown in Figure 2 since there is nothing new this document introduces with regard to those procedures.¶

Once the tunnel is established, it is possible for the Media Distributor to relay the DTLS messages between the endpoint and the Key Distributor. Figure 2 shows a message flow wherein the endpoint uses DTLS-SRTP to establish an association with the Key Distributor. In the process, the Media Distributor shares its supported SRTP protection profile information (see [RFC5764]) and the Key Distributor shares HBH keying material and selected cipher with the Media Distributor.¶

Endpoint              Media Distributor          Key Distributor
    |                         |                         |
    |                         |<=======================>|
    |                         |    TLS Connection Made  |
    |                         |                         |
    |                         |========================>|
    |                         | SupportedProfiles       |
    |                         |                         |
    |------------------------>|========================>|
    | DTLS handshake message  | TunneledDtls            |
    |                         |                         |
         .... may be multiple handshake messages ...
    |                         |                         |
    |<------------------------|<========================|
    | DTLS handshake message  |            TunneledDtls |
    |                         |                         |
    |                         |                         |
    |                         |<========================|
    |                         |               MediaKeys |

After the initial TLS connection has been established each of the messages on the right-hand side of Figure 2 is a tunneling protocol message as defined in Section 6.¶

SRTP protection profiles supported by the Media Distributor will be sent in a SupportedProfiles message when the TLS tunnel is initially established. The Key Distributor will use that information to select a common profile supported by both the endpoint and the Media Distributor to ensure that HBH operations can be successfully performed.¶

As DTLS messages are received from the endpoint by the Media Distributor, they are forwarded to the Key Distributor encapsulated inside a TunneledDtls message. Likewise, as TunneledDtls messages are received by the Media Distributor from the Key Distributor, the encapsulated DTLS packet is forwarded to the endpoint.¶

The Key Distributor will provide the SRTP [RFC3711] keying material to the Media Distributor for HBH operations via the MediaKeys message. The Media Distributor will extract this keying material from the MediaKeys message when received and use it for HBH encryption and authentication.¶

5. Tunneling Procedures

The following sub-sections explain in detail the expected behavior of the endpoint, the Media Distributor, and the Key Distributor.¶

It is important to note that the tunneling protocol described in this document is not an extension to TLS or DTLS. Rather, it is a protocol that transports DTLS messages generated by an endpoint or Key Distributor as data inside of the TLS connection established between the Media Distributor and Key Distributor.¶

6. Tunneling Protocol

Tunneled messages are transported via the TLS tunnel as application data between the Media Distributor and the Key Distributor. Tunnel messages are specified using the format described in [RFC8446] section 3. As in [RFC8446], all values are stored in network byte (big endian) order; the uint32 represented by the hex bytes 01 02 03 04 is equivalent to the decimal value 16909060.¶

This protocol defines several different messages, each of which contains the following information:¶

• Message type identifier¶
• Message body length¶
• The message body¶

Each of the tunnel messages is a TunnelMessage structure with the message type indicating the actual content of the message body.¶

enum {
    supported_profiles(1),
    unsupported_version(2),
    media_keys(3),
    tunneled_dtls(4),
    endpoint_disconnect(5),
    (255)
} MsgType;

opaque uuid[16];

struct {
    MsgType msg_type;
    uint16 length;
    select (MsgType) {
        case supported_profiles:  SupportedProfiles;
        case unsupported_version: UnsupportedVersion;
        case media_keys:          MediaKeys;
        case tunneled_dtls:       TunneledDtls;
        case endpoint_disconnect: EndpointDisconnect;
  } body;
} TunnelMessage;

uint8 SRTPProtectionProfile[2]; /* from RFC5764 */

struct {
    uint8 version;
    SRTPProtectionProfile protection_profiles<2..2^16-1>;
} SupportedProfiles;

struct {
    uint8 highest_version;
} UnsupportedVersion;

struct {
    uuid association_id;
    SRTPProtectionProfile protection_profile;
    opaque mki<0..255>;
    opaque client_write_SRTP_master_key<1..255>;
    opaque server_write_SRTP_master_key<1..255>;
    opaque client_write_SRTP_master_salt<1..255>;
    opaque server_write_SRTP_master_salt<1..255>;
} MediaKeys;

struct {
    uuid association_id;
    opaque dtls_message<1..2^16-1>;
} TunneledDtls;

struct {
    uuid association_id;
} EndpointDisconnect;

7. Example Binary Encoding

The TunnelMessage is encoded in binary following the procedures specified in [RFC8446]. This section provides an example of what the bits on the wire would look like for the SupportedProfiles message that advertises support for both DOUBLE_AEAD_AES_128_GCM_AEAD_AES_128_GCM and DOUBLE_AEAD_AES_256_GCM_AEAD_AES_256_GCM [RFC8723].¶

TunnelMessage:
         message_type: 0x01
               length: 0x0007
    SupportedProfiles:
                   version:  0x00
       protection_profiles:  0x0004 (length)
                             0x0009000A (value)

Thus, the encoding on the wire presented here in network bytes order would be this stream of octets:¶

0x0100070000040009000A

8. IANA Considerations

This document establishes a new registry to contain message type values used in the DTLS Tunnel protocol. These message type values are a single octet in length. This document defines the values shown in Table 1 below, leaving the balance of possible values reserved for future specifications:¶

The value 0x00 is reserved and all values in the range 0x06 to 0xFF are available for allocation. The procedures for updating this table are those defined as "IETF Review" in section 4.8 of [RFC8126].¶

The name for this registry is "Datagram Transport Layer Security (DTLS) Tunnel Protocol Message Types for Privacy Enhanced Conferencing".¶

9. Security Considerations

Since the procedures in this document relies on TLS [RFC8446] for transport security, the security considerations for TLS should be reviewed when implementing the protocol defined in this document.¶

While the tunneling protocol defined in this document does not use DTLS-SRTP [RFC5764] directly, it does convey and negotiate some of the same information (e.g., protection profile data). As such, a review of the security considerations found in that document may be useful.¶

This document describes a means of securely exchanging keying material and cryptographic transforms for both E2E and HBH encryption and authentication of media between an endpoint and a Key Distributor via a Media Distributor. Additionally, the procedures result in delivering HBH information to the intermediary Media Distributor. The Key Distributor and endpoint are the only two entities with access to both the E2E and HBH keys, while the Media Distributor has access to only HBH information. Section 8.2 of [RFC8871] enumerates various attacks against which one must guard when implementing a Media Distributor and are important to note.¶

A requirement in this document is that a TLS connection between the Media Distributor and the Key Distributor be mutually authenticated. The reason for this requirement is to ensure that only an authorized Media Distributor receives the HBH keying material. If an unauthorized Media Distributor gains access to the HBH keying material, it can easily cause service degradation or denial by transmitting HBH-valid packets that ultimately fail E2E authentication or replay protection checks (see Section 3.3.2 of [RFC3711]). Even if service does not appear degraded in any way, transmitting and processing bogus packets are a waste of both computational and network resources.¶

The procedures defined in this document assume that the Media Distributor will properly convey DTLS messages between the endpoint and Key Distributor. Should it fail in that responsibility by forwarding DTLS messages from endpoint A advertised as being from endpoint B, this will result in a failure at the DTLS layer those DTLS sessions. This could be an additional attack vector that Key Distributor implementations should consider.¶

While E2E keying material passes through the Media Distributor via the protocol defined in this document, the Media Distributor has no means of gaining access to that information and therefore cannot affect the E2E media processing function in the endpoint except to present it with invalid or replayed data. That said, any entity along the path that interferes with the DTLS exchange between the endpoint and the Key Distributor, including a malicious Media Distributor that is not properly authorized, could prevent an endpoint from properly communicating with the Key Distributor and, therefore, prevent successful conference participation.¶

It is worth noting that a compromised Media Distributor can convey information to an adversary such as participant IP addresses, negotiates protection profiles, or other metadata. While [RFC8871] explains that a malicious or compromised Media Distributor can disrupt communications, an additional attack vector introduced by this protocol is the potential disruption of DTLS negotiation or premature removal of a participant from a conference by sending an EndpointDisconnect disconnect message to the Key Distributor.¶

The Key Distributor should be aware of the possibility that a malicious Media Distributor might transmit an EndpointDisconnect message to the Key Distributor when the endpoint is, in fact, still connected.¶

While the Security Considerations section of [RFC8871] describes various attacks one needs to consider with respect to the Key Distributor and denial-of-service, use of this protocol introduces another possible attack vector. Consider the case where a malicious endpoint sends unsolicited DTLS-SRTP messages to a Media Distributor. The Media Distributor will normally forward those messages to the Key Distributor and, if found invalid, such messages only serve to consume resources on both the Media Distributor and Key Distributor.¶

10. Acknowledgments

The author would like to thank David Benham and Cullen Jennings for reviewing this document and providing constructive comments.¶

Authors' Addresses