Re: [rtcweb] SRTP not mandatory-to-use

[Bernard Aboba <[e-mail]>]

Romain said:

"Can you name a single soft-phone, hard-phone, SBC, or gateway that currently supports DTLS-SRTP? "

[BA] Yes, I can name a single implementation shipping in commercial products :)  However, for ZRTP, I believe there are multiple (independent?) implementations.  

Romain also said:

"The reason I am asking is libsrtp, despite being widely used, is extremely buggy (last official release for instance crashes with GPF), and does not even provide full DES-SRTP implementation (no F8_128_HMAC_SHA1_8 support).


As far as DTLS (non-SRTP) implementations are concerned, can anybody provide an indication on how widely they are used? I know that OpenSSL supported DTLS for a while, but what commonly used software is using this?"

[BA] DTLS is not supported within Windows 7 or Windows Phone 7.5.  Overall, I would say that DTLS is not widely used at the moment, though I do think it's fair to say that interest is increasing. 


Finally, Romain said:

"Also, what would be the impact of adding DTLS to SBC? It would be interesting to hear from SBC implementers before decision is made.

How many additional round trips does DTLS require for connection setup? Are we planning to support certificate validation?"

[BA] By "certificate validation" do you mean PKI support?  Or are we talking about something along the lines of what is in SIP DTLS/SRTP or the RTCWEB security draft Appendix (e.g. support for self-signed certs and fingerprint validation)?