Re: [rtcweb] Areas of security concern

On 12 Mar 2014, at 05:11, Watson Ladd <watsonbladd@gmail.com> wrote:
> Dear all,
> I've jotted down the following notes when reading the drafts from here and the W3C as potential problem areas. Maybe there are things I've missed in the drafts that address them, but I think they are still worth thinking about. Some of these are more W3C, but we seem to be in charge of the security. These issues vary widely in seriousness. One of them is a demonstrated break of confidentiality, while several are open questions about how we communicate to users.
…
> Problem 7: VBR privacy leaks
> 
> I can do no better then to refer to the paper. http://www.infsec.cs.uni-saarland.de/teaching/WS08/Seminar/reports/yes-we-can.pdf Spoken phrases could be identified from encrypted data alone, using a Hidden Markov Model when the length of packets was preserved by the encryption.

The security considerations in draft-ietf-rtcweb-rtp-usage-12 refer to RFC 6562, which I believe gives recommendations to address this.

Colin

> Conclusion:
> Some of these issues result from well-known problems in older protocols. Others are longstanding difficult problems that have to be solved. Some are quite dangerous, while others will only permit the occasional prank. However, it is not enough to fix these specifically. Large areas of the proposal have not been explored by me. If I had to rate these by seriousness, problem 3 and 7 are the worst. They are luckily the easiest to fix.
> 
> Sincerely,
> Watson Ladd
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb

-- 
Colin Perkins
http://csperkins.org/