Re: [rtcweb] Final plea about SRTP

Cullen Jennings <> Wed, 02 May 2012 21:32 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id BFCBC11E80C2 for <>; Wed, 2 May 2012 14:32:48 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.532
X-Spam-Status: No, score=-2.532 tagged_above=-999 required=5 tests=[AWL=0.067, BAYES_00=-2.599]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id NKHGef2BLLXk for <>; Wed, 2 May 2012 14:32:47 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 2DAAD11E808F for <>; Wed, 2 May 2012 14:32:47 -0700 (PDT)
Received: from [] (unknown []) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPSA id 5DEC322DD6D; Wed, 2 May 2012 17:32:40 -0400 (EDT)
Mime-Version: 1.0 (Apple Message framework v1084)
Content-Type: text/plain; charset="us-ascii"
From: Cullen Jennings <>
In-Reply-To: <>
Date: Wed, 02 May 2012 15:32:38 -0600
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
References: <>
To: Roman Shpount <>
X-Mailer: Apple Mail (2.1084)
Subject: Re: [rtcweb] Final plea about SRTP
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 02 May 2012 21:32:48 -0000


One comment on this - I think people understand there could be services with no security requirements that could run over RTP, and HTTP, with no identity. But we need to have a secure solution for some other services. The questions is once you have a secure solution, what is the incentive to also support an insecure solution - so far no one has come up with a super compelling story about dealing with the bid down and I suspect that lots of people did not view the overhead of running the secure version as all that high. I suspect that is part of why the decisions went the way it did - basically people agreed we needed a secure solution, and when they considered also having an insecure solution, they saw lots of complications of doing both and not much gain in the insecure solution over the secure solution. 


On May 2, 2012, at 10:03 AM, Roman Shpount wrote:

> I know there was a consensus call on this list that SRTP shall be used for all the calls in WebRTC, but I still do not understand the justification for this requirement for WebRTC applications delivered over HTTP with no identity. For such scenarios SRTP (even DTLS-SRTP) serves almost no purpose. If application is delivered over HTTP attacker can spoof the entire web site. It is trivial if the attacker is on the communications path. If attacker is seating in the airport using the same network, it can put itself on the communications path using arp cache poisoning. Once the web site is spoofed, any type of man in the middle attack can be implemented. If DTLS-SRTP is used user can detect the attack by checking the key signature, but in reality very few people will do this.
> The main argument to require SRTP everywhere was that it does not break anything. But neither would naming all the API methods in High Elfish. Either requirement does not break things, but make working with WebRTC harder then it should. At the same time both of those requirements are completely unjustified.
> Furthermore, assumption on this list that most of the WebRTC use would be peer-to-peer communications between browsers with all the rest of the communication modes, such as calling automated services or PSTN being insignificant. I simply do not agree to this point of view. I expect that communication with automated services, such as video greeting cards or voice blogging, would be a significant portion of WebRTC user base. If such automated service is deployed as a plain HTTP web site, it should be able to communicate with web browsers using RTP. SRTP in such case would serve no purpose.
> Finally, requiring secure communications for everything is going against the way most of the web works. Most of it is not secured and only requires secure communications when secure (HTTPS) web site is accessed. I think it should be the same for WebRTC, with DTLS-SRTP required when connected to HTTPS web site and plain RTP allowed when connected to plan HTTP.
> _____________
> Roman Shpount
> _______________________________________________
> rtcweb mailing list