Re: [rtcweb] No Interim on SDES at this juncture

[Hadriel Kaplan <[e-mail]>]

On Jun 20, 2013, at 6:24 PM, Richard Barnes <[e-mail]> wrote:

> It's more secure in the sense that it makes a malicious web server do more work: It forces the web server to act as the PBX and terminate DTLS, instead of just pulling the key out of the SDP and decrypting media.  So the browser user is (incrementally) better protected against the malicious web server.

Uh huh.  So, like, the only people who could afford to do that and would want to do that would be criminals, drug dealers, mobsters, casinos, news organizations, political parties, and governments then?  Phew!  And here I was being worried.

But wait a minute... I was under the distinct impression from people in this group that doing DTLS-SRTP termination on the gateways was no big deal for "modern" servers... that it was so cheap and trivial that your cell phone could do it for umpteen streams... that we shouldn't be worried about the overhead of it whatsoever.  Surely you can't be telling me that it's at all difficult for someone running a malicious web site to do it?!?
;)


> It's more secure in the sense that JS can't access the key, so an injected script can't grab the key and exfiltrate it.  So the browser user is better protected against XSS risks.

This part I'd like to understand better.  Can you explain it?  
If a Browser cannot determine what server the JS being executed for WebRTC API calls/callbacks came from, or cannot tell if it came from one over HTTPS in particular, then using SDES might be a real problem.  I was under the impression browsers did know those things (or at least that they're theoretically supposed to, ignoring that  there are "bugs" here and there).


> It's more secure in the sense that SDES has no end-to-end authentication [1], so implementing SDES creates bid-down attacks.  If an attacker can't get a valid identity, he just claims not to support DTLS-SRTP.  So the browser user is better protected against bid-down attacks by remote users (e.g., the malicious web server's PBX).

This is just another symptom of talking to a malicious web server, and basically a repeat of the argument that DTLS-EKT is "more secure" because a malicious web server has to do a little more work to steal everything.  It's like being stuck in a big cage with a man-eating lion and deciding to run around in circles in the hopes the lion isn't going to chase you.  If he's hungry at all, you're dead; chasing you down is not sufficiently more difficult for him to stay hungry.

-hadriel