Session Description Protocol (SDP) Offer/Answer Procedures For Stream Control Transmission Protocol (SCTP) over Datagram Transport Layer Security (DTLS) Transport.

SDP (Session Description Protocol) provides a general-purpose format for describing multimedia sessions in announcements or invitations. TCP-Based Media Transport in the Session Description Protocol (SDP) specifies a general mechanism for describing and establishing TCP streams. Connection-Oriented Media Transport over the Transport Layer Security (TLS) Protocol in SDP extends RFC4145 for describing TCP-based media streams that are protected using TLS. The Stream Control Transmission Protocol (SCTP) is a transport protocol used to establish associations between two endpoints. specifies how SCTP can be used on top of the Datagram Transport Layer Security (DTLS) protocol, referred to as SCTP-over-DTLS. This specification defines the following new Session Description Protocol (SDP) protocol identifiers (proto values):'UDP/DTLS/SCTP' and 'TCP/DTLS/SCTP'. This specification also specifies how to use the new proto values with the SDP Offer/Answer mechanism for negotiating SCTP-over-DTLS associations. NOTE: Due to the characteristics of TCP, usage of 'TCP/DTLS/SCTP' will always force ordered and reliable delivery of the SCTP packets, which limits the usage of the SCTP options. Therefore, it is strongly RECOMMENDED that TCP is only used in situations where UDP traffic is blocked.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in .

SCTP Association: A protocol relationship between SCTP endpoints, composed of the two SCTP endpoints and protocol state information including Verification Tags and the currently active set of Transmission Sequence Numbers (TSNs), etc. An association can be uniquely identified by the transport addresses used by the endpoints in the association. SCTP Stream: A unidirectional logical channel established from one to another associated SCTP endpoint, within which all user messages are delivered in sequence except for those submitted to the unordered delivery service. SCTP-over-DTLS: SCTP used on top of DTLS, as specified in .

This section defines the following new SDP Media Description (m- line) protocol identifiers (proto values) for describing an SCTP association: 'UDP/DTLS/SCTP' and 'TCP/DTLS/SCTP'. The section also describes how an m- line, associated with the proto values, is created. The following is the format for an 'm' line, as specified in RFC4566 :

... ]]> The 'UDP/DTLS/SCTP' and 'TCP/DTLS/SCTP' proto values are similar to both the 'UDP' and 'TCP' proto values in that they only describe the transport-layer protocol and not the upper-layer protocol. NOTE: When the 'UDP/DTLS/SCTP' and 'TCP/DTLS/SCTP' proto values are used, the underlying transport protocol is respectively UDP and TCP; SCTP is carried on top of DTLS which is on top of those transport-layer protocols. The m- line fmt value, identifying the application-layer protocol, MUST be registered by IANA.

The new proto values are defined as below: The 'UDP/DTLS/SCTP' proto value describes an SCTP association on top of a DTLS association on top of UDP, as defined in . The 'TCP/DTLS/SCTP' proto value describes an SCTP association on top of a DTLS association on top of TCP, as defined in .

defines that specifications defining new proto values must define the rules by which their media format (fmt) namespace is managed. An m- line with a proto value of 'UDP/DTLS/SCTP' or 'TCP/DTLS/SCTP' always describes a single SCTP association. In addition, such m- line MUST further indicate the application-layer protocol using an 'fmt' identifier. There MUST be exactly one 'fmt' value per m- line associated with the proto values defined in this specification. The "fmt" namespace associated with those proto values describes the generic application usage of the entire SCTP association, including the associated SCTP streams. defines the IANA registry for the media format namespace. NOTE: A mechanism on how to describe, and manage, individual SCTP streams within an SCTP association, is outside the scope of this specification. defines a mechanism for negotiating individual SCTP streams used to realize WebRTC data channels .

This section defines the values that can be used within an SDP media description ("m=" line) associated with an SCTP-over-DTLS association. This specification creates an IANA registry for 'association-usage' values.

: "application" : "UDP/DTLS/SCTP" or "TCP/DTLS/SCTP" : UDP port number (for "UDP/DTLS/SCTP") TCP port number (for ""UDP/DTLS/SCTP") : a string denoting the association-usage, limited to the syntax of a 'token' as defined in RFC4566. ]]>

This section defines a new SDP media-level attribute, 'sctp-port'. The attribute can be associated with an SDP media description (m- line) with a 'UDP/DTLS/SCTP' or a 'TCP/DTLS/SCTP' proto value. In that case the m- line port value indicates the port of the underlying transport layer protocol (UDP or TCP), and the 'sctp-port' value indicates the SCTP port. No default value is defined for the SDP sctp-port attribute. Therefore, if the attribute is not present, the associated m- line MUST be considered invalid. NOTE: This specification only defines the usage of the SDP 'sctp-port' attribute when associated with an m- line containing one of the following proto values: 'UDP/DTLS/SCTP' or 'TCP/DTLS/SCTP'. Usage of the attribute with other proto values needs to be defined in a separate specification.

[RFC EDITOR NOTE: Please replace RFCXXXX with the RFC number of this document.] The definition of the SDP 'sctp-port' attribute is:

The SCTP port range is between 0 and 65535 (both included). Leading zeroes MUST NOT be used. Example: a=sctp-port:5000 ]]>

The mux category for the SDP 'sctp-port' attribute is SPECIAL. As the usage of multiple SCTP associations on top of a single DTLS association is outside the scope of this specification, no mux rules are specified for the 'UDP/DTLS/SCTP' and 'TCP/DTLS/SCTP' proto values. Future extensions, that define how to negotiate multiplexing of multiple SCTP associations of top of a single DTLS association, need to also define the mux rules for the attribute.

This section defines a new SDP media-level attribute, 'max-message-size'. The attribute can be associated with an m- line to indicate the maximum SCTP user message size (indicated in bytes) that an SCTP endpoint is willing to receive on the SCTP association associated with the m- line. Different attribute values can be used in each direction. An SCTP endpoint MUST assume that larger SCTP user message sizes will be rejected by the peer SCTP endpoint. SCTP endpoints need to decide on appropriate behavior in case a message needs to be sent in which the SCTP user message size exceeds thevmaximum SCTP user message size. If the SDP 'max-message-size' attribute contains a maximum message size value of zero, it indicates the SCTP endpoint will handle messages of any size, subject to memory capacity etc. If the SDP 'max-message-size' attribute is not present, the default value is 64K. NOTE: This specification only defines the usage of the SDP 'max-message-size' attribute when associated with an m- line containing one of the following proto values: 'UDP/DTLS/SCTP' or 'TCP/DTLS/SCTP'. Usage of the attribute with other proto values needs to be defined in a separate specification.

[RFC EDITOR NOTE: Please replace RFCXXXX with the RFC number of this document.] The definition of the SDP 'max-message-size' attribute is:

Leading zeroes MUST NOT be used. Example: a=max-message-size:100000 ]]>

The mux category for the SDP 'max-message-size' attribute is SPECIAL. As the usage of multiple SCTP associations on top of a single DTLS association is outside the scope of this specification, no mux rules are specified for the 'UDP/DTLS/SCTP' and 'TCP/DTLS/SCTP' proto values.

The UDP/DTLS/SCTP transport is realized as described below: SCTP on top of DTLS is realized according to the procedures defined in ; and DTLS on top of UDP is realized according to the procedures in defined in . NOTE: While allows multiple SCTP associations on top of a single DTLS association, the procedures in this specification only support the negotiation of a single SCTP association on top of any given DTLS association.

The TCP/DTLS/SCTP transport is realized as described below: SCTP on top of DTLS is realized according to the procedures defined in ; and DTLS on top of TCP is realized using the framing method defined in , with DTLS packets being sent instead of RTP/RTCP packets, and SDP signaling according to the procedures defined in this specification. NOTE: DTLS on top of TCP, without using the framing method defined in is outside the scope of this specification. A separate proto value would need to be registered for such transport realization.

This section describes how to mange an SCTP association, DTLS association and TCP connection using SDP attributes. The SCTP association, the DTLS association and the TCP connection are managed independently from each other. Each can be established and closed without impacting others. The detailed SDP Offer/Answer procedures for the SDP attributes are described in .

This specification does not define semantics for the SDP direction attributes . Unless semantics of these attributes for an SCTP association usage have been defined, SDP direction attributes MUST be ignored if present.

When an SCTP association is established, both SCTP endpoints MUST initiate the SCTP association (i.e. both SCTP endpoints take the 'active' role), and MUST use the same SCTP port as client port and server port (in order to prevent two separate SCTP associations from being established). As both SCTP endpoints take the 'active' role, the SDP 'setup' attribute does not apply to SCTP association establishment. However the 'setup' attribute does apply to establishment of the underlying DTLS association and TCP connection. NOTE: The procedure above is different from TCP, where one endpoint takes the 'active' role, the other endpoint takes the 'passive' role, and only the 'active' endpoint initiates the TCP connection . NOTE: When the SCTP association is established it is assumed that any NAT traversal procedures for the underlying transport protocol (UDP or TCP) have successfully been performed. The SDP 'connection' attribute does not apply to the SCTP association. In order to trigger the closure of an existing SCTP association, and establishment of a new SCTP association, the SDP 'sctp-port' attribute [] is used to indicate a new (different than the ones currently used) SCTP port. The existing SCTP association is closed, and the new SCTP association is established, if one or both endpoints signal a new SCTP port. The 'connection' attribute does apply to establishment of underlying TCP connections. Alternatively, an SCTP association can be closed using the SDP 'sctp-port' attribute with a zero attribute value. Later, a new SCTP association can be established using the procedures in this section for establishing an SCTP association. SCTP associations might be closed without SDP signalling, e.g, in case of a failure. The procedures in this section MUST be followed to establish a new SCTP association. This requires a new SDP Offer/Answer exchange. New (different than the ones currently used) SCTP ports MUST be used by both endpoints. NOTE: Closing and establishing a new SCTP association using the SDP 'sctp-port' attribute will not impact the underlying DTLS association.

A DTLS association is managed according to the procedures in . Hence, the SDP 'setup' attribute is used to negotiate the (D)TLS roles ('client' and 'server') . NOTE: The SDP 'setup' attribute is used to negotiate both the DTLS roles and the TCP roles (). NOTE: As described in , if the Interactive Connectivity Establishment (ICE) mechanism is used, all ICE candidates associated with a DTLS association are considered part of the same DTLS association. Thus, a switch from one candidate pair to another candidate pair will not trigger the establishment of a new DTLS association.

The TCP connection is managed according to the procedures in . Hence, the SDP 'setup' attribute is used to negotiate the TCP roles ('active' and 'passive'), and the SDP 'connection' attribute is used to indicate whether to use an existing TCP connection, or create a new one. The SDP 'setup' attribute 'holdconn' value MUST NOT be used. NOTE: A change of the TCP roles will also trigger a closure of the DTLS association, and establishment of a new DTLS association, according to the procedures in . NOTE: As specified in , usage of the SDP 'setup' attribute 'holdconn' value is not allowed. Therefore this specification also forbids usage of the attribute value for TCP, as DTLS is transported on top of TCP.

This section defines the SDP Offer/Answer procedures for negotiating and establishing an SCTP-over-DTLS association. Unless explicitly stated, the procedures apply to both the 'UDP/DTLS/SCTP' and 'TCP/DTLS/SCTP' m- line proto values. Each endpoint MUST associate one or more certificate fingerprints, using the SDP 'fingerprint' attribute with the m- line, following the procedures in . The authentication certificates are interpreted and validated as defined in . Self-signed certificates can be used securely, provided that the integrity of the SDP description is assured as defined in . Each endpoint MUST associate an SDP 'dtls-id' attribute with the m- line, following the procedures in .

When the offerer creates an initial offer, the offerer: MUST associate an SDP setup attribute with the m- line; MUST associate an SDP 'sctp-port' attribute with the m- line; MUST, in the case of TCP/DTLS/SCTP, associate an SDP 'connection' attribute, with a 'new' attribute value, with the m- line; and MAY associate an SDP 'max-message-size' attribute [] with the m- line.

When the answerer receives an offer, which contains an m- line describing an SCTP-over-DTLS association, if the answerer accepts the association, the answerer: MUST insert a corresponding m- line in the answer, with an identical m- line proto value ; MUST associate an SDP 'setup' attribute with the m- line; MUST associate an SDP 'sctp-port' attribute with the m- line. If the offer contained a new (different than the one currently used) SCTP port value the answerer MUST also associate a new SCTP port value. If the offer contained a zero SCTP port value, or if the answerer does not accept the SCTP association, the answerer MUST also associate a zero SCTP port value; and MAY associate an SDP 'max-message-size' attribute [] with the m- line. The attribute value in the answer is independent from the value (if present) in the corresponding m- line of the offer. Once the answerer has sent the answer the answerer: MUST, in the case of TCP/DTLS/SCTP, if a TCP connection has not yet been established, or if an existing TCP connection is to be closed and replaced by a new TCP connection, follow the procedures in for closing and establishing a TCP connection; MUST, if a DTLS association has not yet been established, or if an existing DTLS association is to be closed and replaced by a new DTLS association, follow the procedures in for closing establishing a DTLS association; and MUST, if an SCTP association has not yet been established, or if an existing SCTP association is to be closed and replaced by a new SCTP association, initiate the closing of the existing SCTP association (if applicable) and establishment of the SCTP association. If the SDP 'sctp-port' attribute in the answer contains a zero attribute value, the answerer MUST NOT establish an SCTP association. If an SCTP association exists, the offerer MUST close it. If the answerer does not accept the m- line in the offer, it MUST assign a zero port value to the corresponding m- line in the answer, following the procedures in . In addition, the answerer MUST NOT initiate the establishment of a TCP connection, a DTLS association or a DTLS association associated with the m- line.

Once the offerer has received the answer the offerer: MUST, in the case of TCP/DTLS/SCTP, if a TCP connection has not yet been established, or if an existing TCP connection is to be closed and replaced by a new TCP connection, follow the procedures in for closing and establishing a TCP connection; MUST, if a DTLS association has not yet been established, or if an existing DTLS association is to be closed and replaced by a new DTLS association, follow the procedures in for closing and establishing a DTLS association; and MUST, if an SCTP association has not yet been established, or if an existing SCTP association is to be closed and replaced by a new SCTP association, initiate the closing of the existing SCTP association (if applicable) and establishment of the SCTP association. If the SDP 'sctp-port' attribute in the answer contains a zero attribute value, the offerer MUST NOT establish an SCTP association. If an SCTP association exists in that case, the offerer MUST close it. If the m- line in the answer contains a zero port value, the offerer MUST NOT initiate the establishment a TCP connection, a DTLS association or an SCTP association associated with the m- line. If a TCP connection, or a DTLS association or an SCTP association exists in that case, the offerer MUST close it.

When an offerer sends an updated offer, in order to modify a previously established SCTP association, it follows the procedures in , with the following exceptions: If the offerer wants to close an SCTP association, and immediately establish a new SCTP association, the offerer MUST associate an SDP 'sctp-port' attribute with a new (different than the one currently used) attribute value. This will not impact the underlying DTLS association (and TCP connection in case of TCP/DTLS/SCTP). If the offerer wants to close an SCTP association, without immediately establishing a new SCTP association, the offerer MUST associate an SDP 'sctp-port' attribute with a zero attribute value. This will not impact the underlying DTLS association (and TCP connection in case of TCP/DTLS/SCTP). If the offerer wants to establish an SCTP association, and another SCTP association was previously closed, the offerer MUST associate an SDP 'sctp-port' attribute with a new attribute value (different than the value associated with the previous SCTP association). If the previous SCTP association was closed successfully following use of an SDP 'sctp-port' attribute with a zero attribute value, the offerer MAY use the same attribute value for the new SCTP association that was used with the previous SCTP association before it was closed. This will not impact the underlying DTLS association (and TCP connection in case of TCP/DTLS/SCTP). If the offerer wants to close an existing SCTP association, and the underlying DTLS association (and the underlying TCP connection in case of TCP/DTLS/SCTP) it MUST assign a zero port value to the m- line associated with the SCTP and DTLS associations (and TCP connection in case of TCP/DTLS/SCTP), following the procedures in . NOTE: This specification does not define a mechanism for explicitly closing a DTLS association while maintaining the overlying SCTP association. However, if a DTLS association is closed and replaced with a new DTLS association, as a result of some other action , the SCTP association is not affected. The offer follows the procedures in regarding the DTLS association impacts when modifying a session. In the case of TCP/DTLS/SCTP, the offerer follows the procedures in regarding the TCP connection impacts when modifying a session.

Multihoming is not supported when sending SCTP on top of DTLS, as DTLS does not expose address management of the underlying transport protocols (UDP or TCP) to its upper layer.

When SCTP-over-DTLS is used in NAT environment, it relies on the NAT traversal procedures for the underlying transport protocol (UDP or TCP).

When SCTP-over-DTLS is used with UDP based ICE candidates then the procedures for UDP/DTLS/SCTP [] are used. When SCTP-over-DTLS is used with TCP based ICE candidates then the procedures for TCP/DTLS/SCTP [] are used. Implementations MUST treat all ICE candidate pairs associated with an SCTP association on top of a DTLS association as part of the same DTLS association. Thus, there will only be one SCTP handshake and one DTLS handshake even if there are multiple valid candidate pairs, and shifting from one candidate pair to another will not impact the SCTP or DTLS associations. If new candidates are added, they will also be part of the same SCTP and DTLS associations. When transitioning between candidate pairs, different candidate pairs can be currently active in different directions and implementations MUST be ready to receive data on any of the candidates, even if this means sending and receiving data using UDP/DTLS/SCTP and TCP/DTLS/SCTP at the same time in different directions. When an SDP offer or answer is sent, the proto value MUST match the transport protocol associated with the default candidate. Hence, if UDP transport is used for the default candidate the 'UDP/DTLS/SCTP' proto value MUST be used. If TCP transport is used for the default candidate the 'TCP/DTLS/SCTP' proto value MUST be used. However, if an endpoint switches between TCP-based and UDP-based candidates during a session the endpoint is not required to send an SDP offer in order to modify that proto value of the associated m- line. NOTE: The text in the paragraph above only applies when the usage of ICE has been negotiated. If ICE is not used, the proto value MUST always reflect the transport protocol used at any given time.

defines general SDP security considerations, while , and define security considerations when using the SDP offer/answer mechanism to negotiate media streams. defines general SCTP security considerations and defines security considerations when using SCTP on top of DTLS. This specification does not introduce new security considerations in addition to those defined in the specifications listed above.

[RFC EDITOR NOTE: Please replace RFCXXXX with the RFC number of this document.] This document updates the "Session Description Protocol (SDP) Parameters" registry, following the procedures in , by adding the following values to the table in the SDP "proto" field registry: Type SDP Name Reference proto UDP/DTLS/SCTP [RFCXXXX] proto TCP/DTLS/SCTP [RFCXXXX]

This document defines a new SDP media-level attribute,'sctp-port'. The details of the attribute are defined in .

This document defines a new SDP media-level attribute,'max-message-size'. The details of the attribute are defined in .

[RFC EDITOR NOTE: Please replace RFCXXXX with the RFC number of this document.] This specification creates a new IANA registry, following the procedures in , for the "fmt" namespace associated with the 'UDP/DTLS/SCTP' and 'TCP/DTLS/SCTP' protocol identifiers. Each "fmt" value describes the usage of an entire SCTP association, including all SCTP streams associated with the SCTP association. NOTE: Usage indication of individual SCTP streams is outside the scope of this specification. The "fmt" value, "association-usage", used with these "proto" values is required. It is defined in . As part of this registry, IANA maintains the following information: The identifier of the subprotocol, as will be used as the "fmt" value. A reference to the document in which the association-usage is defined. association-usage names are to be subject to the "First Come First Served" IANA registration policy [RFC5226]. IANA is asked to add initial values to the registry.

The authors wish to thank Harald Alvestrand, Randell Jesup, Paul Kyzivat, Michael Tuexen, Juergen Stoetzer-Bradler, Flemming Andreasen and Ari Keranen for their comments and useful feedback.

[RFC EDITOR NOTE: Please remove this section when publishing] Changes from draft-ietf-mmusic-sctp-sdp-19 Changes based on WG chair comments from Flemming Andreasen. Changes from draft-ietf-mmusic-sctp-sdp-18 Changes based on WGLC comments from Paul Kyzivat. Changes from draft-ietf-mmusic-sctp-sdp-17 Removal of 'SCTP'. Document title changed. Disallow usage of SDP 'setup' attribute 'holdconn' value. Roman Shpount added as co-editor. Changes from draft-ietf-mmusic-sctp-sdp-15 Chapter about SCTP, DTLS and TCP association/connection management modified. Removal of SCTP/DTLS. Changes from draft-ietf-mmusic-sctp-sdp-14 Changes based on WGLC comments from Magnus Westerlund. - ABNF clarification that token and port are defined in RFC4566. - Specify 40 as maximum digit character length for the SDP max-message-size value. - Editorial clarification. Changes based on discussions at IETF#92. - Specify that all ICE candidate pairs belong to the same DTLS association. Changes from draft-ietf-mmusic-sctp-sdp-13 Changes based on comments from Paul Kyzivat. - Text preventing usage of well-known ports removed. - Editorial clarification. Changes from draft-ietf-mmusic-sctp-sdp-12 Mux category rules added for new SDP attributes. Reference to draft-ietf-mmusic-sdp-mux-attributes added. Changes based on comments from Roman Shpount: - Specify that fingerprint or setup roles must not be modified, unless underlying transport protocol is also modified. Changes based on comments from Ari Keranen: - Editorial corrections. Changes based on comments from Flemming Andreasen: - Clarify that, if UDP/DTLS/SCTP or TCP/DTLS/SCTP is used, the DTLS association is established before the SCTP association. - Clarify that max-message-size value is given in bytes, and that different values can be used per direction. - Section on fmtp attribute removed. - Editorial corrections. Changes from draft-ietf-mmusic-sctp-sdp-11 Example added. Changes from draft-ietf-mmusic-sctp-sdp-10 SDP max-message-size attribute added to IANA considerations. Changes based on comments from Paul Kyzivat: - Text about max message size removed from fmtp attribute section. Changes from draft-ietf-mmusic-sctp-sdp-09 'DTLS/SCTP' split into 'UDP/DTLS/SCTP' and 'TCP/DTLS/SCTP' Procedures for realizing UDP/DTLS/SCTP- and TCP/DTLS/SCTP transports added. Changes from draft-ietf-mmusic-sctp-sdp-08 Default SCTP port removed: - Usage of SDP sctp-port attribute mandatory. SDP max-message-size attribute defined: - Attribute definition. - SDP Offer/Answer procedures. Text about SDP direction attributes added. Text about TLS role determination added.