Subject: New sdr 2.5a5 released

From: Mark Handley <[email-masked]>
Date: Fri, 14 Aug 1998 16:25:00 -0400

A new version of the Multicast Session Directory tool sdr is now
available from UCL's ftp server: ftp://cs.ucl.ac.uk/mice/sdr/2.5a5.
Binaries are available there for FreeBSD, Irix, Linux, Solaris and
Windows 95/98/NT4.  Source is also there if you need to build sdr for
other platforms.  If you do so, AND YOU ARE OUTSIDE THE USA,
please contribute the binary and Makefile back to Colin Perkins
([email-masked]) at UCL.

The version of sdr fixes a number of bugs that have been observed with
previous versions.  In addition, it implements the Session Initiation
Protocol more or less in compliance with the current internet draft.
(I say more or less, because the SIP code is currently relatively
untested, and SIP over TCP is known to be buggy in this version of
sdr).  The SIP implementation in sdr is mine - please mail me if you
discover any problems with it.

Also Ed Whelan ([email-masked]) and Goli Montasser-Kohsari
([email-masked]) at UCL have fully implemented the
SAP security specification.  In this latest version of SDR the
following security features have been included:

 1) Media Tool Encryption

  The media tools can, if the tool supports it, be started encrypted. A
  key is specified when creating the announcement and this can be either
  a randomly generated key or a key specified by the user. Different random
  keys are used by default but the user can set each tool to use the same 
  key if desired. The tools currently support symmetric DES encryption.

 2) Session Announcement Encryption

  The session announcement can be encrypted either symmetrically or 
  asymmetrically.

  a) Symmetric Encryption

     The algorithm used in this case is DES.

  b) Asymmetric Encryption

     Either PGP or PKCS#7 security formats can be used. In the case of 
     PGP the user must have PGP 2.6.3 installed whereas with PKCS#7
     the SECUDE security toolkit is necessary. With asymmetric encryption
     the announcment is encrypted with the public key of a group and
     can only be decrypted by members of the group who have access to 
     the corresponding private key. The group key pairs are distributed
     by secure means prior to the setting up of a conference group.

 3) Session Announcement Authentication

  The session announcemnt can be authenticated using either PGP or 
  PKCS#7 (SECUDE). In this case the session announcement is signed with 
  the originator's private key and so anyone with access to the originator's
  public key can be sure that the announcement came from the originator
  and has not been changed en route. It is also an option to send the 
  originator's certificate along with the signed announcement.

  Any combination of tool encryption, session announcemnt encryption and
  session announcement authentication are allowed.

  The precise formats used for the above features are as detailed in the
  latest SAP specification

Please mail Ed or Goli if you have any comments on the security
implementation, or mail [email-masked] to reach us all.  

Since sdr now utilizes strong encryption, I am no longer the primary
maintainer of the code - the group at UCL have taken over this task.
General sdr bug reports should be sent to [email-masked].

Cheers,
	Mark