Re: [rtcweb] Asking TLS for help with media isolation

Martin said:

"I have pointed to draft-thomson-tls-acp as a potential solution here,
but others have noted that ALPN tokens could be used."

Watson said:

"Putting on my TLS hat, TLS already lets you send data across the
network securely. Why does this bit need to be treated differently
from all others?

[BA] As Martin indicates, the desire for isolation needs to be communicated
to ensure that remote media is not misused.  With either of the TLS
approaches that Martin has suggested,  the desire for isolation is
communicated directly between the peers.   Having this occur E2E via media,
not hop-by-hop via signaling avoids the risk of a MITM preventing isolation
from being negotiated.

However once the desire for isolation is communicated E2E (either via ACP
or ALPN tokens), there is nothing in the SRTP traffic (keyed by DTLS/SRTP)
that indicates that the traffic is to be isolated.

On Thu, Apr 3, 2014 at 6:51 PM, Watson Ladd <watsonbladd@gmail.com> wrote:

> On Thu, Apr 3, 2014 at 5:14 PM, Martin Thomson <martin.thomson@gmail.com>
> wrote:
> > As I described briefly at the last meeting, ensuring that media is
> > isolated from the application or web site is a key part of addressing
> > our security goals.
> >
> > The key part of that is making sure that any media that is isolated on
> > the sending side of RTCPeerConnection remains isolated when it reaches
> > the other side.
> >
> > As I noted, this is also necessary in order to ensure the integrity of
> > the same origin model.  In that model, cross origin media is required
> > to be inaccessible to content, and as it stands RTCPeerConnection
> > could be used to work around those restrictions (implementations can
> > implement other protections, as Firefox already does).
> >
> > The alternatives as I see them (and I hope that this is sufficiently
> > exhaustive) are:
> >
> >  1. ask the TLS working group for a TLS-based solution
> >  2. build something into the session signaling (i.e., new SDP bits)
> >  3. give up on the idea
> >
> > I prefer 1 for reasons already outlined.
>
> Putting on my TLS hat, TLS already lets you send data across the
> network securely. Why does this bit need to be treated differently
> from all others?
>
> Sincerely,
> Watson Ladd
>
>
> --
> "Those who would give up Essential Liberty to purchase a little
> Temporary Safety deserve neither  Liberty nor Safety."
> -- Benjamin Franklin
>
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb
>