[rtcweb] SRTP not mandatory-to-use

[Xavier Marjou <[e-mail]>]

Hi,


During the last IETF meeting, there seemed to be many people willing to
have SRTP mandatory-to-use in the browser. However, I would like again to
underline that in some contexts, it is rather desirable to deactivate, via
the WebRTC API, the use of SRTP in order not to encrypt/decrypt at multiple
layers.


This may be the case in the following example: a company wants to use
WebRTC for communications between its co-workers only; the web server and
the script using WebRTC API are located on the VPN. In such a case, there
is no need to use SRTP. The VPN already provides encryption when needed. If
co-workers want to remotely access the VPN, an IPsec tool can already
provide the encryption. Furthermore, if they want to remotely access the
VPN via a 3G network, there will be encryption at layer 2 using AKA, then
IPsec at layer 3, and again at SRTP level if mandatory-to-use.


Cheers,

Xavier