IETF Logo Mail Archive

Re: [rtcweb] Consensus call regarding media security

"Ravindran, Parthasarathi" <pravindran@sonusnet.com> Sat, 31 March 2012 10:06 UTC

Return-Path: <pravindran@sonusnet.com>
X-Original-To: rtcweb@ietfa.amsl.com
Delivered-To: rtcweb@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B278521F86CF for <rtcweb@ietfa.amsl.com>; Sat, 31 Mar 2012 03:06:39 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.112
X-Spam-Level:
X-Spam-Status: No, score=-5.112 tagged_above=-999 required=5 tests=[AWL=1.187, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h34Ni5bTb2bn for <rtcweb@ietfa.amsl.com>; Sat, 31 Mar 2012 03:06:38 -0700 (PDT)
Received: from na3sys010aog102.obsmtp.com (na3sys010aog102.obsmtp.com [74.125.245.72]) by ietfa.amsl.com (Postfix) with ESMTP id 5877921F86C1 for <rtcweb@ietf.org>; Sat, 31 Mar 2012 03:06:38 -0700 (PDT)
Received: from usma-ex-hub1.sonusnet.com ([69.147.176.212]) (using TLSv1) by na3sys010aob102.postini.com ([74.125.244.12]) with SMTP ID DSNKT3bXLV2IjkwCLMMzbS4txGg0kbM/yOHM@postini.com; Sat, 31 Mar 2012 03:06:38 PDT
Received: from INBA-HUB02.sonusnet.com (10.70.51.87) by usma-ex-hub1.sonusnet.com (66.203.90.16) with Microsoft SMTP Server (TLS) id 14.2.247.3; Sat, 31 Mar 2012 06:06:59 -0400
Received: from INBA-MAIL01.sonusnet.com ([fe80::8d0f:e4f9:a74f:3daf]) by inba-hub02.sonusnet.com ([fe80::80b9:dc60:caf7:7dfc%11]) with mapi id 14.01.0355.002; Sat, 31 Mar 2012 15:36:33 +0530
From: "Ravindran, Parthasarathi" <pravindran@sonusnet.com>
To: Iñaki Baz Castillo <ibc@aliax.net>
Thread-Topic: [rtcweb] Consensus call regarding media security
Thread-Index: AQHNDPJEz8d54ZuGqkmrgP2aJufnWZaBgBgw//+tvoCAAwF88A==
Date: Sat, 31 Mar 2012 10:06:56 +0000
Message-ID: <387F9047F55E8C42850AD6B3A7A03C6C0E222F4B@inba-mail01.sonusnet.com>
References: <4F732531.2030208@ericsson.com> <387F9047F55E8C42850AD6B3A7A03C6C0E221877@inba-mail01.sonusnet.com> <CALiegfkV=UCfOvcuC_Uwr8wdmHjM0eAYMSjW7Vt52DCqKJRm1Q@mail.gmail.com>
In-Reply-To: <CALiegfkV=UCfOvcuC_Uwr8wdmHjM0eAYMSjW7Vt52DCqKJRm1Q@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [121.242.142.186]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Cc: "rtcweb@ietf.org" <rtcweb@ietf.org>
Subject: Re: [rtcweb] Consensus call regarding media security
X-BeenThere: rtcweb@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <rtcweb.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/rtcweb>
List-Post: <mailto:rtcweb@ietf.org>
List-Help: <mailto:rtcweb-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 31 Mar 2012 10:06:40 -0000

Inaki,

I agree with your argument of allowing HTTP as it fit with this trust model. 

Please note that I request for plain RTP with user consent (configuration) as it will fit within trust model with exception. I'm saying that SRTP-DTLS is the only mechanism which meets all the requirement as of now in the listed candidates. Having said that, in case anybody convince for changing the trust model then SDES shall be considered or SDES may be preferred over SRTP-DTLS. IMO, trust model should help for selecting security key mechanism.

I'll reply to another thread separately.

Thanks
Partha

>-----Original Message-----
>From: Iñaki Baz Castillo [mailto:ibc@aliax.net]
>Sent: Thursday, March 29, 2012 11:03 PM
>To: Ravindran, Parthasarathi
>Cc: rtcweb@ietf.org
>Subject: Re: [rtcweb] Consensus call regarding media security
>
>2012/3/29 Ravindran, Parthasarathi <pravindran@sonusnet.com>:
>> WebRTC trust model has to be considered as one of the main factor for
>deciding the key mechanism. AFAIK, SDES does not fit into WebRTC as
>Dr.Evil HTTPS RTCWeb server must be trusted in case of SDES. There is no
>means to track or analyze whether Dr.Evil involves in monitoring or
>recording or terminate the media traffic.  It will be good in case
>whoever advocate for SDES explain how SDES fits within WebRTC trust
>model.
>
>If Dr. Evil attaks my back webpage and owns it, and then I visit it
>(HTTPS with valid certificate) and enter my back credentials... for me
>that is much worse than the case you describe. Should we drop HTTPS then
>because it does not fit 100% "security" requirements?
>
>BTW: previously you wanted to allow plain RTP in WebRTC... and now DTLS-
>SRTP is the only valid solution? :)
>
>--
>Iñaki Baz Castillo
><ibc@aliax.net>

v2.46.0 | Report a Bug | By Email | System Status