Re: [rtcweb] Let's define the purpose of WebRTC

Hi Partha

I feel including all kinds of security mechanisms like SRTP, TLS, etc in browser would make the browser very bulky. It would be better to provide a mechanism in the signaling protocol that browser supports to negotiate the desired security mechanism (depending on application requirement) and then use that mechanism (which is part of the system).

Regards
Ranjit

-----Original Message-----
From: rtcweb-bounces@ietf.org [mailto:rtcweb-bounces@ietf.org] On Behalf Of Ravindran Parthasarathi
Sent: Wednesday, November 09, 2011 11:54 AM
To: Muthu Arul Mozhi Perumal (mperumal); Cullen Jennings (fluffy); Olle E. Johansson
Cc: rtcweb@ietf.org
Subject: Re: [rtcweb] Let's define the purpose of WebRTC

Hi Muthu,

I agree with you that Defense & Financial Enterprise customer mandates for security mechanism in media path but it is not mandated for rest of the Enterprise customer. The argument here is whether it is "mandatory to implement" vs "mandatory to use". I agree that it is mandatory to implement in browser but it is not required to be mandatory to use by all the applications. Hope you agree with me.

Thanks
Partha

>-----Original Message-----
>From: Muthu Arul Mozhi Perumal (mperumal) [mailto:mperumal@cisco.com]
>Sent: Wednesday, November 09, 2011 9:12 AM
>To: Ravindran Parthasarathi; Cullen Jennings (fluffy); Olle E. Johansson
>Cc: rtcweb@ietf.org
>Subject: RE: [rtcweb] Let's define the purpose of WebRTC
>
>|"1) Security could be in the lower layer itself
>|(IPsec, VPN, private MPLS cloud). For Enterprise-only-
>|WebRTC application (no federation & no interop),
>|there is no need of security for specific application
>|like WebRTC as it is ensured in the infrastructure.
>
>One of the primary deployments for SRTP I've come across is actually
>within the enterprise -- financial institutions and defense
>establishments concerned about eavesdropping within their organization.
>The fact that the WAN connection is secured using IPSec VPN or a private
>leased line isn't good enough for such deployments.
>
>Muthu
>
>|-----Original Message-----
>|From: rtcweb-bounces@ietf.org [mailto:rtcweb-bounces@ietf.org] On
>Behalf Of Ravindran Parthasarathi
>|Sent: Wednesday, November 09, 2011 8:28 AM
>|To: Cullen Jennings (fluffy); Olle E. Johansson
>|Cc: <rtcweb@ietf.org>
>|Subject: Re: [rtcweb] Let's define the purpose of WebRTC
>|
>|Cullen,
>|
>|As I mentioned in
>http://www.ietf.org/mail-archive/web/rtcweb/current/msg02674.html, below
>comment #2
>|is not valid in IETF.
>|
>|But I'm interested in your opinion as Enterprise UC expert on my 1st
>comment:
>|
>|"1) Security could be in the lower layer itself (IPsec, VPN, private
>MPLS cloud). For Enterprise-only-
>|WebRTC application (no federation & no interop), there is no need of
>security for specific application
>|like WebRTC as it is ensured in the infrastructure. WebRTC security
>will be duplicated for these
>|infrastructure and may lead to double encryption unnecessarily."
>|
>|Thanks
>|Partha
>|
>|>-----Original Message-----
>|>From: Cullen Jennings [mailto:fluffy@cisco.com]
>|>Sent: Tuesday, November 08, 2011 9:29 PM
>|>To: Olle E. Johansson
>|>Cc: Ravindran Parthasarathi; <rtcweb@ietf.org>
>|>Subject: Re: [rtcweb] Let's define the purpose of WebRTC
>|>
>|>
>|>On Nov 8, 2011, at 7:58 AM, Olle E. Johansson wrote:
>|>
>|>>>
>|>>> 2) Being in India, I'm interested in avoiding Government
>restriction
>|>on WebRTC proposal (Thanks to Tim for pointing this). I may not
>surprise
>|>to see that WebRTC mechanism is banned in India because intelligent
>|>agency struggles to break the key in each terrorist WebRTC site.
>|>(http://www.pcworld.com/businesscenter/article/235639/india_wants_to_i
>nt
>|>ercept_skype_google_communications.html)
>|>> That is an interesting objection. I don't think SRTP by default is
>the
>|>problem here. In the case where you need lawful interception in the
>|>application,
>|>> the server needs to route the calls through an RTCweb b2b media
>|>server.
>|>
>|>I think the situation in India is a taxiation not encryption issue.
>|>Partha and I can do VoIP between Canada and India fully encrypted no
>|>problem - in fact we have a dial plan set up specifically so I can do
>|>that with him. The issue is a taxation issue. If we want to be able to
>|>connect that voip server to the PSTN in a way that it becomes what the
>|>regulators in India consider a telephone service, then we need
>|>permission to effectively be an indian telco. Right now I can make a
>|>full SRTP encrypted conversation with between my IP phones and
>Partha's
>|>but I don't think Partha can use his IP phone to access one the the
>PSTN
>|>GWs outside India.
>|>
>|>Anyways, I will remind people of RAVEN http://www.rfc-
>|>editor.org/rfc/rfc2804.txt
>|>
>|
>|_______________________________________________
>|rtcweb mailing list
>|rtcweb@ietf.org
>|https://www.ietf.org/mailman/listinfo/rtcweb
_______________________________________________
rtcweb mailing list
rtcweb@ietf.org
https://www.ietf.org/mailman/listinfo/rtcweb