Re: [Perc] Last Call: <draft-ietf-perc-private-media-framework-08.txt> (A Solution Framework for Private Media in Privacy Enhanced RTP Conferencing) to Proposed Standard

[Sergio Garcia Murillo <[e-mail]>]

On 01/02/2019 17:18, Richard Barnes wrote:
> So I would propose we add something like the following to this 
> definition:
>
> "In the context of WebRTC, where control of a session is divided 
> between a JavaScript application and a browser, the browser acts as 
> the Trusted Endpoint for purposes of this framework (just as it acts 
> as the endpoint for DTLS-SRTP in one-to-one calls).


If we decide to adopt perc (big if) in webrtc, shouldn't this be defined 
within the 
https://tools.ietf.org/html/draft-ietf-rtcweb-security-arch-17 doc ?


    Optimally, we would not rely on trust in any entities other than the
    browser.  However, this is unfortunately not possible if we wish to
    have a functional system.  Other network elements fall into two
    categories: those which can be authenticated by the browser and thus
    can be granted permissions to access sensitive resources, and those
    which cannot be authenticated and thus are untrusted.


WebRTC already IdP as trusted for identity purposes, so it should be up 
to the RTCWEB group to decide what is a trusted endpoint and what is not 
in webrtc. As Bernard is stating, we could decide that there are other 
key management solutions trusted (even in JS or WASM), as for for 
example is being done in EME:

https://github.com/WICG/media-capabilities/blob/master/explainer.md#encryption

Best regards

Sergio