[rtcweb] Support of SDES in WebRTC

["Fabio Pietrosanti (naif)" <[e-mail]>]

On the topic of SDES vs DTLS-SRTP a very nice analysis has been done on:
http://www.potaroo.net/ietf/idref/draft-ohlsson-rtcweb-sdes-support/

Considering how vague are the security implementation consideration of
DTLS-SRTP and how widely diffused in SDES-SRTP, i'm wondering whenever
we should not mandate the use of SDES-SRTP.

That way we would be able to see:

- All implementation will start with SDES (simpler and quicker)
- For who want enhanced security, greater implementation and
interoperability complexity, implement also DTLS-SRTP

But for the industry a full cycle of:
- Implementation
- Stabilization
- Interoperability

for DTLS-SRTP (that nobody use) may require from 2 up to 4-5 years of time.

If we goes for SDES-SRTP by default, as early choice, probably within
1-2 years at maximum we can expect the overall technological ecosystem
to be stable and interoperable.

Because it will be built on top of existing stable framework.

We may save dozens millions of USD of investments costs for the industry
and gain some hundreds millions of users year in advance, just because
we would save several years of time.

I think that those consideration are valuable enough to strongly
consider arguments in making SDES-SRTP a preferred, mandatory
implementation for WebRTC.

-- 
Fabio Pietrosanti
Founder, CTO

Tel: [phone] (direct)
Mobile: [phone]
E-mail: [e-mail]
Skype: fpietrosanti
Linkedin: http://linkedin.com/in/secret

PrivateWave Italia S.p.A.
Via Gaetano Giardino 1 - 20123 Milano - Italy
www.privatewave.com