Re: [rtcweb] SDP Security Descriptions (RFC 4568) and RTCWeb

[Tim Panton <[e-mail]>]

On 26 Apr 2013, at 14:33, Harald Alvestrand wrote:

> On 04/26/2013 03:16 PM, Tim Panton wrote:
>> 
>> On 26 Apr 2013, at 12:37, Iñaki Baz Castillo wrote:
>> 
>>> Such a solution requires a very expensive gateway. Good for vendors but bad for all the rest.
>>> 
>> 
>> I don't understand why the DTLS gateway would be so expensive. It is _exactly_ the same
>> (conceptually) as the ICE processing - you filter off a few UDP packets from the stream, do some
>> stuff, send replies then once you are happy you punt some dynamic settings back up to the (s)rtp
>> layer.
> 
> So you're saying that the gateway doesn't have to decrypt and re-encrypt the packets?

It depends where it is a gateway to. I'm claiming that the huge majority of the legacy side endpoints
are going to be wanting plain RTP anyhow, so no need to re-encrypt.
Another chunk of functionality is local processing (conference mixing, call recording, ivr etc) where 
the device (or it's cluster) is the endpoint, so again no need to re- encrypt.

The decryption can be handled by existing SRTP components, which just need to be fed the keys
generated by the DTLS exchange.

(And I'd add that we got into this mess by sticking with O/A semantics. )

T.