Re: [rtcweb] Resolving RTP/SDES question in Paris

[Eric Rescorla <[e-mail]>]

On Sat, Mar 17, 2012 at 9:33 AM, Ravindran, Parthasarathi
<[e-mail]> wrote:
> Tim,
>
> I think that you miss the point of RTP and ICE are (IPSec) encrypted between (RTCWeb client) endpoint and Enterprise during VPN connection. So, RTP & ICE packets from endpoint are routed in WiFi ISP as IP packet with encrypted payload and no security issues.

Partha,

I don't find the scenario you suggest particularly compelling.

Yes, it's true that it's more secure to run your communications over
a VPN than not, but it's not obviously the case that you necessarily
trust everyone who is on the VPN (after all, this is why companies
with VPNs run internal access controls on their systems). And it's
of course yet more secure to run point-to-point encryption even
when you are operating on a VPN.

With that said, even if we were to stipulate that the VPN case
is safe, you haven't explained why it's desirable not to cryptographically
protect the traffic in that case. Since it's easier and safer to
simply have only a secure mode of operation, I don't see
that this scenario is an argument in favor of RTP.

-Ekr