Re: [rtcweb] AVPF [was: Encryption mandate (and offer/answer)]

[Matthew Kaufman <[e-mail]>]

On 9/11/11 3:39 PM, Timothy B. Terriberry wrote:
>> * The level of media protection to use (NONE, SDES-SRTP or DTLS-SRTP) 
>> should be set by the web app
>
> Why wouldn't this devolve to, "Don't communicate anything. Instead, 
> try to create a PeerConnection with DTLS-SRTP, and when that fails, 
> try to create a second one with NONE," in the actual webapp.

Yes.

>
> Or, more likely, since NONE will have a better chance of working with 
> legacy devices, "Try to create a PeerConnection with NONE, and when 
> that fails, try to create a second one with DTLS-SRTP." Assuming 
> anyone bothers with the second step. 

Yes, I believe this is why ekr suggested in his email that 
DTLS-SRTP-only is more likely to result in encrypted connections than 
having both choices available is.

> Having the choice of SDES-SRTP or DTLS-SRTP will also make it more 
> likely people won't bother with either, as they won't know which one 
> to use.

Agree. This is the best reason for not supporting SDES for keying.
> We can try to create incentives with browser chrome, but there's only 
> so much that can do.
Agree.

The best way to evaluate this is "if I was the one sitting in a cafe 
using this, what would I want my browser to do"... and the answer to 
*that* question is "I always want DTLS-SRTP between my browser and the 
other end, or worst case, the gateway". (Even if there seem to be good 
reasons to support plain RTP.)

Matthew Kaufman