Re: [rtcweb] Preserving stream isolation when traversing the network

On 7 Mar 2014, at 09:59, Martin Thomson <martin.thomson@gmail.com> wrote:

> On 6 March 2014 14:21, Martin Thomson <martin.thomson@gmail.com> wrote:
>> There is another option I really just thought of, and that is to add
>> an authenticated parameter to RTP for this purpose.  Probably as an
>> RTP header extension.  This has different properties, mostly which
>> apply to the scope question.
> 
> Having thought about this, I think that we can discount it.  A
> security property of this sort needs to be reliably attached to the
> stream.  That means an extension in every SRTP packet if we do it that
> way.  In the (D)TLS handshake, it costs much less.

Where in the DTLS handshake? There is a risk that if it is too early, 
then we are raising an un encrypted flag saying to the DPI crowd 
"look at me, I'm interesting".

The whole thrust of the IETF's 'encrypt all the things' is to make encryption
default and therefor unexceptional, we shouldn't do anything that makes
isolated calls visibly 'special'.

T.

> 
> If we wanted isolation on a much more granular level, then this would
> be OK, but I don't think that we should be making it that granular.
> 
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb

Tim Panton - Web/VoIP consultant and implementor
www.westhawk.co.uk