Re: [rtcweb] New use-case proposed

[Michael Welzl <[e-mail]>]

On May 11, 2012, at 11:31 PM, Göran Eriksson AP wrote:

>
>
> 11 maj 2012 kl. 22:52 skrev "Harald Alvestrand"  
> <[e-mail]>:
>
>> On 05/11/2012 06:38 PM, Göran Eriksson AP wrote:
>>>
>>> 11 maj 2012 kl. 18:21 skrev "Harald  
>>> Alvestrand"<[e-mail]>:
>>>
>>>> I propose to reject this use case because it requires yet another
>>>> security redesign.
>>>> The clue is here:
>>>>
>>>>> - The keying solution must allow each participants to encrypt to
>>>>> multiple receivers without any decryption+encryption in the  
>>>>> middle node
>>>>>
>>>> This means that each participant must use the same encryption  
>>>> keys to
>>>> all other participants; this in turn means that when someone  
>>>> leaves the
>>>> group, all participants must change their encryption keys; it  
>>>> also means
>>>> that as long as shared keys are used for authentication, all
>>>> participants can impersonate all other participants.
>>>>
>>>> In fact, this solution has most of the issues (except for the  
>>>> network
>>>> layer deployment issue) that leads me to strongly advocate leaving
>>>> multicast out of scope for this effort.
>>> You mean for this phase of webrtc std efforts or for ever?
>> Until we've got an usage scenario with a deployment story that I find
>> credible.
>>
>> The point I'm pretty vehement on - that lack of multicast support  
>> should
>> not be a blocker for finalizing the specs we are working on.
>>
>
> I am pretty sensitive to such consequence as well! Having said that,  
> enabling innovation in this kind of application category is  
> important  for the long term evolution of the web platform.
>
> Personally, I would like to us to ensure we have at least have a  
> good foundation for multicast later.

+1 (to both parts of this)

Cheers
Michael