Markdown Version | Session Recording

Session Date/Time: 27 Mar 2023 06:30

sframe

Summary

This sframe working group meeting focused on resolving open issues on the sframe draft to enable a working group last call. The meeting involved a detailed review of open GitHub issues, discussing potential resolutions, and assigning action items to the editors. Key topics included stream definitions, key management, replay protection, Rt integration, and metadata handling.

Key Discussion Points

• Issue #100: Stream Definition: Debate on whether to include a stream definition in the document. The consensus leaned toward not defining a new stream construct within sframe itself, but requiring applications to specify key usage context.
• Key Management: Discussion about specifying application requirements for key management, including key rotation and security properties.
• Issue #97: Out of Scope Key Management: Clarifying the boundaries of key management responsibilities.
• Issue #96: Rt Specifics: Agreement to audit the document and ensure Rt mentions are primarily examples, maintaining the document's generality. Testing implementation over webrtc data channel.
• Overhead Analysis (PR): A pull request redoing overhead analysis was flagged for review.
• Issue #76: Replay Protection: Extensive discussion on replay protection, considering scope, potential timing oracles, and transport layer protections. A proposal emerged to note the security trade-offs and allow applications to implement replay windows (timer-based or counter-based) if needed, without mandating a specific mechanism.
• Issue #70: Adoption Call Feedback: Identified as needing individual issue breakouts.
• Issue #17: Authenticated Metadata: Debate on the necessity of an authenticated metadata field. There were concerns about potential misuse and the need for application-level agreement on metadata content. There was a resolution keep the field but provide warnings in the spec text.
• Issue #3: Var Structure: Consideration of using quick varints. This was rejected.

Decisions and Action Items

• Issue #100 (Stream Definition): Editors to clarify application requirements for key usage. Action: Richard, Sergio
• Issue #97 (Out of Scope Key Management): Document security properties achieved with specific key rotation practices. Action: Richard, Sergio
• Issue #96 (Rt Specifics): Audit and remove non-essential Rt references. Editors also encouraged to test the code with webrtc data channels and to keep two flavors of implementation. Action: Richard, Sergio
• Overhead Analysis (PR): Review and provide feedback on the pull request. Action: Justin (reminder needed)
• Issue #76 (Replay Protection): Editors to document the security trade-offs and allow applications to implement replay windows (timer-based or counter-based) if needed, without mandating a specific mechanism. Action: Richard, Sergio
• Issue #70 (Adoption Call Feedback): Break out into individual issues. Action: TBD (assigned to in absentia)
• Issue #17 (Authenticated Metadata): Keep the authenticated metadata feature, add text describing what the application has to do, and confirm necessity during WG Last Call. Action: Richard, Sergio, Yu
• Issue #3 (Var Structure): Close the issue. Action: Richard, Sergio
• Key Retry: It has to have a retry mechanism, it has to clear signal of retry. It also can not be marked as a replay. Action: Richard, Sergio
• Key Structure Leakage: Document the leakage of the sections, if application is concerned then they can use another approach. Action: Martin
• Editors: Richard, Sergio

Next Steps

• The editors will address the action items and prepare a revised draft.
• A virtual interim meeting will be scheduled in about a month, with a poll for times. The meeting will be canceled if the editors provide a satisfactory draft before then.
• Continue to nail the punch list the application has to fill out