Re: [rtcweb] SDP Security Descriptions (RFC 4568) and RTCWeb

[Tim Panton <[e-mail]>]

On 26 Apr 2013, at 18:59, Roman Shpount wrote:
> 
> The arguments why SDES is required in some cases instead of DTLS are:
> 
> 1. Additional call setup delay caused by DTLS

This is a serious problem - made worse by the O/A semantics - I think we will find that in real usage
sites will pre-warm a DTLS connection so it is ready to go when the user clicks connect.

> 
> 2. High computational load on each call setup. This can be significant with high number of short calls being setup. This would be especially significant for any sort of server interfacing WebRTC or WebRTC to SIP gateway.

I would dispute this - remember exactly the same users have almost certainly logged into an https:// portal - indeed only a small 
percentage of them will start a DTLS session for during any given web session. The web seems to still be working.

> 
> 3. High complexity -- you are doubling or tripling amount of code you need in your SRTP stack to support DTLS negotiations. Most of the code in readily available libraries is not needed and represents no functional value (certificate support, unneeded encryption methods, compression, streaming, etc), but will require a significant amount of support effort and can be a security risk (I am talking about something like OpenSSL or GnuTLS which ends up in the media processing stack).

That's true to an extent, but it only applies to devices that don't already do TLS for something else. 
Webservers, web browsers, Sip/xmpp engines, anything offering an https management interface, will already have that code
in use for other purposes. The DTLS specific code is quite small. 

> 
> As it stands right now, I would prefer never to use DTLS-SRTP with any client to server communication applications, since it has no security value in such scenarios (server can access media anyway) and will cause significant usability, performance, and support issues.

There I also disagree. The ability to offer a DTLS connection that presents a browser checkable x509 certificate for yourbank.com over the
media path in a call to a bank's authorized call center agents might be a significant advantage.

T.
 

> _____________
> Roman Shpount
>  
> _______________________________________________
> rtcweb mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rtcweb