Re: [rtcweb] SDP Security Descriptions (RFC 4568) and RTCWeb

[Dan Wing <[e-mail]>]

On May 7, 2013, at 7:55 AM, Henry Lum <[e-mail]> wrote:

> Does the signalling and DTLS media stream need to use the same certificate or the certificates

No, DTLS-SRTP does not require they have the same certificate.  It does require the certificate fingerprint be sent in call signaling (in the SDP a=fingerprint line), and that the certificate exchanged in DTLS match that fingerprint.  This binds the call signaling to the media.

-d


> can be from the same organization right? The contact center gateway and the recording element would be different components and hence have different certificates from the same organization.
> 
> I agree it would be useful for a browser to warn the user that the media stream is coming from a different identity than the signalling if we agree that DTLS is the only transport.
> 
> Regards,
> Henry
> 
> -----Original Message-----
> From: Tim Panton [mailto:[e-mail]] 
> Sent: May-07-13 4:50 AM
> To: Henry Lum
> Cc: Dan Wing; Harald Alvestrand; [e-mail]
> Subject: Re: [rtcweb] SDP Security Descriptions (RFC 4568) and RTCWeb
> 
> 
> On 6 May 2013, at 15:30, Henry Lum wrote:
> 
>> Chiming in late.
>> 
>> Speaking from a contact center perspective, a lot of calls are required to be recorded. In order to allow active recording (such as SIPREC), the contact center has to provide a media endpoint for bridging media so that a copy of the media can be created. The users will have to trust the contact center to handle the media anyways, and the media must be decrypted and re-encrypted by some media element within the contact center to perform recording. To me DTLS-SRTP-EKT does not provide any additional benefit over SDES for this type of use case.
> 
> It can provide an identity benefit. A bank contact center can offer an x509 certificate (from a trusted CA) over the DTLS media stream. 
> That's a big difference from the web server offering a cert over https - the channel that may be shared with the signalling channel, which in turn 
> may have set up the media.
> 
> Direct assertion vs 2 uncertain hops.
> 
> Of course the utility of that depends on the combined UX of the browser chrome and the site, but at least it is possible...
> 
> There should perhaps be some extra chrome 'bling' if the cert that arrives over DTLS matches the HTTPS one that brought the signalling.
> 
> T.
> 
>