Re: [rtcweb] Tunnelling DTLS in SDP

> On 4 Apr 2016, at 16:52, Roman Shpount <roman@telurix.com> wrote:
> 
> 
> I think sending certificate in the answer instead of data path does not compromise security since if signaling path is compromised, data traffic can be redirected to MITM agent which can collect exactly the same data.

That isn’t quite the same, currently in a MITM’d scenario you have the option of not completing the DTLS handshake (assuming you had a way
to verify the fingerprints.). With this change you’ll have all the certs logged in a web server somewhere.

> 
> This has the benefit over sending DTLS handshake using ICE/STUN messages that it does not need to deal with packet fragmentation and reassembly.

DTLS does have support for packet assembly/disassembly. I’d be surprised if the DTLS handshake packets exceeded a reasonable MTU,
unless you are sending a full chain of certificates or stuffing a logo into the x509 :-) 

Stepping back from the detail, (D)TLS implementations are brittle enough as it is, we should avoid introducing a whole new level
of complexity if we can. Implementing this piggybacking in ICE at least keeps it in the media path, rather than spreading it through the
signalling and web servers too.

T.

> 
> Regards,
> _____________
> Roman Shpount
> 
> On Mon, Apr 4, 2016 at 9:10 AM, Eric Rescorla <ekr@rtfm.com <mailto:ekr@rtfm.com>> wrote:
> Hi folks,
> 
> I wanted to call your attention to a draft I just published with a possibly stupid
> idea.
> 
> https://tools.ietf.org/html/draft-rescorla-dtls-in-sdp-00 <https://tools.ietf.org/html/draft-rescorla-dtls-in-sdp-00>
> 
> A nontrivial fraction of call setup time in WebRTC is the DTLS handshake.
> This document describes how to piggyback the first few handshake messages
> in the SDP offer/answer exchange, thus reducing latency.
> 
> Comments welcome.
> 
> -Ekr
> 
> 
> 
> 
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org <mailto:rtcweb@ietf.org>
> https://www.ietf.org/mailman/listinfo/rtcweb <https://www.ietf.org/mailman/listinfo/rtcweb>
> 
> 
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb