[VOIPSEC] Really RTP is end-to-end?

[Yaron Sheffer]

Hi Dan,

This adds another interesting angle to the "security at the signaling or the media layer" discussion. Previously security at the signaling level was mainly in order to counter fraud (assuming you have full key exchange at the media level, unlike sdes). Now with KPML the most sensitive part of the call suddenly goes into SIP. Take for example the case when I call my bank's IVR, and use KPML to send my account number and PIN.

Thanks,
	Yaron

> -----Original Message-----
> From: Dan Wing [mailto:dwing at cisco.com]
> Sent: Wednesday, July 19, 2006 5:28
> To: 'Simon Horne'; 'Wence Van der Meersch'
> Cc: voipsec at voipsa.org
> Subject: Re: [VOIPSEC] Really RTP is end-to-end?
> 
> > From a SRTP standpoint having DTMF digits carried inband (RFC 2833)
> > is less than ideal as each hop would need to decrypt and re-encrypt
> > the media at each hop just to detect the presence of DTMF digits.
> > Is there a way to carry DTMF digits out of band like other protocols
> > can do?  I mean you can encrypt media right through the asterisk box
> > in H.323
> 
> Yes, it's called KPML.  The document is
> http://www.ietf.org/internet-drafts/draft-ietf-sipping-kpml-07.txt,
> which is in the RFC Editor's queue.  Abstract:
> 
>    This document describes a SIP Event Package "kpml" that enables
>    monitoring of DTMF signals and uses XML documents referred to as Key
>    Press Markup Language (KPML).  The kpml Event Package may be used to
>    support applications consistent with the principles defined in the
>    document titled "A Framework for Application Interaction in the
>    Session Initiation Protocol (SIP)".  The event package uses SUBSCRIBE
>    messages and allows for XML documents that define and describe filter
>    specifications for capturing key presses (DTMF Tones) entered at a
>    presentation-free User Interface SIP User Agent (UA).  The event
>    package uses NOTIFY messages and allows for XML documents to report
>    the captured key presses (DTMF tones), consistent with the filter
>    specifications, to an Application Server.  The scope of this package
>    is for collecting supplemental key presses or mid-call key presses
>    (triggers).
> 
> -d
>