[rtcweb] Which servers to trust (Re: Consensus call regarding media security)

[Harald Alvestrand <[e-mail]>]

Changing the subject, since this message is not a position on the 
consensus call.

On 03/29/2012 07:31 PM, Fabio Pietrosanti (naif) wrote:
> On 3/29/12 7:02 PM, Ravindran, Parthasarathi wrote:
>> WebRTC trust model has to be considered as one of the main factor for deciding the key mechanism. AFAIK, SDES does not fit into WebRTC as Dr.Evil HTTPS RTCWeb server must be trusted in case of SDES. There is no means to track or analyze whether Dr.Evil involves in monitoring or recording or terminate the media traffic.  It will be good in case whoever advocate for SDES explain how SDES fits within WebRTC trust model.
> Sure!
>
> From:
> http://datatracker.ietf.org/doc/draft-ietf-rtcweb-security-arch/?include_text=1
>
> "   The basic assumption of this architecture is that network resources
>     exist in a hierarchy of trust, rooted in the browser, which serves as
>     the user's TRUSTED COMPUTING BASE (TCB).  Any security property which
>     the user wishes to have enforced must be ultimately guaranteed by the
>     browser (or transitively by some property the browser verifies)."
>
> So, it means that if the browser already have a hierarchy of trust to
> use TLS for HTTPS, then SDES-SRTP will inherit the trust-properties of
> the HTTPS website from which it's loaded.
Ahem.... SDES-SRTP will "inherit" the property that as long as the HTTPS 
trust chain is intact, only attacks where the HTTPS website, or entities 
that the HTTPS website chooses to reveal the key to (voluntarily or 
involuntarily) can listen in on the call.

(The plenary at the IETF made interesting background for this claim.)
> It seems to me quite easy to fit SDES-SRTP into the browser model, as it
> allow you to assure that the communication path between the client and
> the server is secure.
>
> Do you expect WebRTC to be only peer-to-peer/client-to-client?
>
> I sincerly expect *a lot* of communications to goes trough SIP/RTP media
> proxy for security purpose, for billing purposes, for value added
> service purpose.
In the cases where a gateway needs to decrypt the packets, the gateway 
is the logical peer with the browser in the (DTLS-)SRTP trust relationship.
> SDES-SRTP provide a very reliable and simple way to let a WebRTC peer to
> establish security with the server, assuming that it already have
> established security trough HTTPS/TLS that's a consolidate trust method.
The term "the server" is a fallacy. The Web server and the media gateway 
(if there is one) are likely not the same server, and may even be 
operated by different entities.
SDES-SRTP forces you to trust both.

>