A description is not authorization
05Untrusted session descriptions can direct traffic to addresses and ports the reader did not intend.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 7 ↗
RFC 8866 · § 7EXAMPLE
3 / 3
03
Protected session setup
Use the surrounding secure signaling and media-keying mechanisms.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Authenticate and integrity-protect SDP using the surrounding application.
- Authenticate and integrity-protect SDP using the surrounding application.
- Do not treat a described address as inherently trusted.
- The obsolete k= field must not be used as a modern key-distribution mechanism.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy