Re: [Perc] PERC LIte

you re' right, those API are not to be exposed to the pass-by internet.

<rant> Alas, as Martin and ear stated in 2014 when asking about making the
screensharing mechanism consistant across browsers, "it's a security
matter, and the security matters are the prerogative of the browser
vendors". So we might end up with extensions in chrome, and profile in
Firefox. </rant> But normal webpages' JS won't have the capacity to set
keys.

The security aspects are not forgotten, and were/are included in the
proposal that was circulated to Chrome and Mozilla teams back in November
last year.

I just wanted to give an heads-up to Bernard about it coming his way in the
immediate future.

;-)

On Thu, May 25, 2017 at 7:42 AM, Mo Zanaty (mzanaty) <mzanaty@cisco.com>
wrote:

> Keys in JS app signaling/APIs??? Have we come full circle back to SDES???
>
> Seems like PERC lite would weaken not strengthen the security of DTLS-SRTP
> / WebRTC apps, if JS can inject keys to ignore DH, defeat PFS, etc.
>
> Confused,
> Mo
>
> From: Perc <perc-bounces@ietf.org> on behalf of Alexandre GOUAILLARD <
> agouaillard@gmail.com>
> Date: Wednesday, May 24, 2017 at 5:14 PM
> To: Sergio Murillo <sergio.garcia.murillo@gmail.com>
> Cc: "perc@ietf.org" <perc@ietf.org>, Bernard Aboba <
> bernard.aboba@gmail.com>
> Subject: Re: [Perc] PERC LIte
>
> bernard,
>
> Good point.
>
> i'm discussing with peter T, and proposal for webrtc WG and ORTC CG API
> extensions are coming your way this week.  Sergio did it at the
> PeerConnection level while peter is advocating an Api at the
> RTPSender/Receiver level. Of course, the crypto-algorithm needs to be an
> input variable as well.
>
> On Thu, May 25, 2017 at 5:46 AM, Sergio Garcia Murillo <
> sergio.garcia.murillo@gmail.com> wrote:
>
>> Hi Bernard,
>>
>> Yes, the example API is just the lazy approach I have taken on my
>> modified chromium, hardcoding the key to AES-GCM 256 so I didn't have to
>> add an object to the IDL and worry about how to retrieve later on the c++
>> code.
>>
>> The API should allow to set the key and look more like:
>>
>> * const pc = new RTCPeerConnection({ mediaCrypto : { key :
>> 'VEhJUyBJUyBUSEUgMzIgS0VZIFdJVEggMTIgU0FMVCBET1VCTEUgUEVSQyE=', suite  :
>> 'AEAD_AES_256_GCM' } });*
>>
>> Anticipating the security comments, I don't expect that to be the final
>> API for WebRTC, which IMHO should be a similar mechanism as the one in
>> place for IdP (or even integrated with it), but I feel that that discussion
>> should take place on the RTCWeb group and not here.
>>
>> Best regards
>> Sergio
>>
>>
>> On 24/05/2017 19:56, Bernard Aboba wrote:
>>
>> Thanks for posting this.
>>
>> Question:  In terms of API support, how is the crypto-algorithm
>> specified?  So far, the proposed API just has the key.
>>
>> On Wed, May 24, 2017 at 10:11 AM, Sergio Garcia Murillo <
>> sergio.garcia.murillo@gmail.com> wrote:
>>
>>> Hi all again,
>>>
>>> Also to start the discussion about 5), I would like to introduce again
>>> my proposal for a "PERC Lite" approach.
>>>
>>> The main objectives and key points of this proposal are:
>>>
>>>    - Minimum viable PERC implementation
>>>    - Minimize impact on both endpoints and MD
>>>    - OHB is carried in the RTP payload (Encrypted Payload Header).
>>>    - No changes to the DTLS/SRTP code/api/standards
>>>    - No RTP E2E Header extensions
>>>    - RTX/FEC/RED is supported HBH without any change to current
>>>    standards/implementations.
>>>
>>> Best regards
>>>
>>> Sergio
>>>
>>>
>>>
>>> _______________________________________________
>>> Perc mailing list
>>> Perc@ietf.org
>>> https://www.ietf.org/mailman/listinfo/perc
>>>
>>>
>>
>>
>> _______________________________________________
>> Perc mailing list
>> Perc@ietf.org
>> https://www.ietf.org/mailman/listinfo/perc
>>
>>
>
>
> --
> Alex. Gouaillard, PhD, PhD, MBA
> ------------------------------------------------------------
> ------------------------
> President - CoSMo Software Consulting, Singapore
> ------------------------------------------------------------
> ------------------------
> sg.linkedin.com/agouaillard
>
>    -
>
>
> _______________________________________________
> Perc mailing list
> Perc@ietf.org
> https://www.ietf.org/mailman/listinfo/perc
>
>

-- 
Alex. Gouaillard, PhD, PhD, MBA
------------------------------------------------------------------------------------
President - CoSMo Software Consulting, Singapore
------------------------------------------------------------------------------------
sg.linkedin.com/agouaillard

   -