Draft: draft-ietf-perc-dtls-tunnel

Commentary: I gave this a quick skim and looks pretty good to me
Paragraph (version B):
SDP RFC4566 attribute MUST be included in SDP sent by the endpoint in
both the offer and answer RFC3264 messages as per I-D.ietf-mmusic-
dtls-sdp.
Paragraph (version B):
value received in SDP.  If the values do not match, the endpoint MUST
consider any received keying material to be invalid and terminate the
DTLS association.
Paragraph (version A):
All messages for an established tunnel MUST utilize the same version
value.  If the version of any subsequent message differs from that of
the initial message, that message MUST be discarded and the tunnel
connection closed.
Paragraph (version A):
The media distributor MUST forward all messages received from an
endpoint for a given DTLS association through the same tunnel if more
than one tunnel has been established between it and a key
distributor.
Paragraph (version A):
The media distributor MUST assign a unique association identifier for
each endpoint-initiated DTLS association and include it in all
messages forwarded to the key distributor.  The key distributor will
subsequently include this identifier in all messages it sends so that
the media distributor can map messages received via a tunnel and
forward those messages to the correct endpoint.  The association
identifier SHOULD be randomly assigned and values not be re-used for
a short period of time (e.g., five minutes) to ensure any residual
state in the key distributor is clear and to ensure any packets
already transmitted from the key distributor are not directed to the
wrong endpoint.
Paragraph (version A):
The tunnel protocol enables the key distributor to separately provide
HBH keying material to the media distributor for each of the
individual endpoint DTLS associations, though the media distributor
cannot decrypt messages between the key distributor and endpoints.
Paragraph (version A):
message.
Paragraph (version A):
The media distributor MUST support the same list of protection
profiles for the life of a given endpoint's DTLS association, which
is represented by the association identifier.
Paragraph (version B):
The media distributor MUST assign a unique association identifier for
each endpoint-initiated DTLS association and include it in all
messages forwarded to the key distributor.  The key distributor will
subsequently include this identifier in all messages it sends so that
the media distributor can map messages received via a tunnel and
forward those messages to the correct endpoint.  The association
identifier MUST be randomly assigned UUID RFC4122 value.
Paragraph (version B):
message.  The media distributor is not required to forward all
messages received from an endpoint for a given DTLS association
through the same tunnel if more than one tunnel has been established
between it and a key distributor.
Paragraph (version B):
Each TLS tunnel established between the media distributor and the key
distributor MUST be mutually authenticated.
Paragraph (version A):
message (see tunneling-protocol).
Paragraph (version B):
do not match, the DTLS association MUST be rejected.
Paragraph (version B):
in SDP is conveyed to the key distributor is outside the scope of
this document.
Paragraph (version B):
Editor's Note: The above can be removed if we agree that the media
distributor will always forward SDP to the key distributor.  That
said, should the media server take on this function or should some
other call control function do this?  The former assumes the media
distributor always has the SDP.
Paragraph (version B):
message with the corresponding values received from the SDP
transmitted by the endpoint.  It is through this correlation that the
key distributor can be sure to deliver the correct conference key to
the endpoint.
Paragraph (version B):
attribute.
Paragraph (version B):
message (see tunneling-protocol).  The key distributor is not
required to transmit all messages a given DTLS association through
the same tunnel if more than one tunnel has been established between
it and a media distributor.
Paragraph (version B):
extension to determine which conference a given DTLS association is
associated.
Paragraph (version B):
message with the association identifier assigned to the endpoint to
the media distributor.
Paragraph (version B):
All messages for an established tunnel MUST utilize the same version
value.
Paragraph (version A):
message does not convey any additional information in the body.