Re: [rtcweb] AVPF [was: Encryption mandate (and offer/answer)]

[Matthew Kaufman <[e-mail]>]

On 9/10/2011 4:47 AM, Roman Shpount wrote:
> SRTP is a simple media encryption using signaling channel exchanged 
> keys and salt to do simple counter mode AES with content signing using 
> HMAC-SHA1. It also implements a dictionary based replay protection. 
> DTLS offers wider encryption and content signing algorithm selection, 
> end-point handshake based on certificates, certificate validation 
> using certificate authority. In general, DTLS offers same protection 
> that TLS does, while SRTP is simplified and optimized for media.

I think you left out a description of DTLS-SRTP and made other 
simplifications.

>
> In regard to the overall discussion, if we want interop with existing 
> VoIP infrastructure, we need to support RTP with AVP. 99% of all SIP 
> deployments do not support and cannot support SRTP. 

They also cannot complete the ICE STUN handshake that is required to 
prove to the browser that they are willing to accept media.

> None of the wholesale VoIP telephony carriers support SRTP (some offer 
> VPN or direct interconnects if you care about privacy). 

Likewise regarding ICE.

> Consumer VoIP companies (like Vonage or Comcast) do not support or use 
> SRTP for any calls from their customer equipment. 

And again regarding ICE.

> In places were encryption is supported (like Skype) it is often either 
> something different from SRTP. In order to connect to all those 
> environments without media proxy we need plain RTP. 

Even if we need plain RTP, that isn't an argument for SDES-keyed SRTP.

Matthew Kaufman