Re: [rtcweb] AVPF [was: Encryption mandate (and offer/answer)]

[Roman Shpount <[e-mail]>]

SRTP is a simple media encryption using signaling channel exchanged keys and
salt to do simple counter mode AES with content signing using HMAC-SHA1. It
also implements a dictionary based replay protection. DTLS offers wider
encryption and content signing algorithm selection, end-point handshake
based on certificates, certificate validation using certificate authority.
In general, DTLS offers same protection that TLS does, while SRTP is
simplified and optimized for media.

In regard to the overall discussion, if we want interop with existing VoIP
infrastructure, we need to support RTP with AVP. 99% of all SIP deployments
do not support and cannot support SRTP. None of the wholesale VoIP telephony
carriers support SRTP (some offer VPN or direct interconnects if you care
about privacy). Consumer VoIP companies (like Vonage or Comcast) do not
support or use SRTP for any calls from their customer equipment. In places
were encryption is supported (like Skype) it is often either something
different from SRTP. In order to connect to all those environments without
media proxy we need plain RTP. Otherwise we will need to put a media proxy
(SBC) to connect to them.

Finally, there is a reasonably low expectation of privacy as far as voice
calls are concerned. Most of the PSTN phone calls go over the wire connected
to an unlocked box outside your house. Anybody (and by this I mean anybody
walking down the street) can listen to your calls including emergency ones.
People like to raise security as concern but for 99% of the calls, as well
as for 99% of the web traffic which goes over HTTP vs HTTPS, nobody cares.
_____________
Roman Shpount


On Sat, Sep 10, 2011 at 3:54 AM, Olle E. Johansson <[e-mail]> wrote:

>
> 9 sep 2011 kl. 21:39 skrev Roman Shpount:
>
>  Please keep in mind that secure media is not limited to SRTP. RTP over
> DTLS is as or more secure then SRTP
>
>
> Interesting. Can you please elaborate? I haven't heard that being stated
> before and it made me curious.
>
> Thanks,
> /O
>