Re: [rtcweb] Security Architecture: SDES support is a MUST

The draft currently states:

     *  The "security characteristics" MUST include some mechanism to
         allow an out-of-band verification of the peer, such as a
         certificate fingerprint or an SAS.

I'd be happy to have us specify a particular fingerprint algorithm (presumably
SHA-256, potentially truncated) but I haven't seen any evidence that
users savvy enough to inspect the fingerprint at all can't navigate more
than one hash. For example, Chrome's SSL/TLS inspector currently displays
MD5 and SHA-1. So I'm not sure something needs to be standardized here.

-Ekr

On Fri, Jul 20, 2012 at 6:28 AM, Harald Alvestrand <harald@alvestrand.no> wrote:
> On 07/20/2012 03:18 PM, Fabio Pietrosanti (naif) wrote:
>>
>> On 7/20/12 3:06 PM, Harald Alvestrand wrote:
>>>>
>>>> Current security definition of WebRTC does not support end-to-end
>>>> security.
>>>
>>> The current security definition of WebRTC (with DTLS) provides
>>> fingerprints.
>>> If the application is able to verify those fingerprints, security is end
>>> to end; if it isn't - it isn't.
>>
>> The security specification already does specify how the fingerprint must
>> be checked, against a third party system that must be trusted (unless
>> there is some recent update i didn't still checked).
>>
>> The way the specification describe fingerprint must be checked, does not
>> enforce end-to-end security but always rely on trusted third party,
>> being IdP (identity providers).
>>
>> The only way to achieve end-to-end security is not to have any kind of
>> trusted third party, as has been already discussed on
>> http://www.ietf.org/mail-archive/web/rtcweb/current/msg04043.html .
>
> That link is your request to have SAS considered mandatory.
>
> I believe you got some support for that proposal, or at least some kind of
> availability of digest information that can be verified independently, but I
> do not believe that you got any support for having SAS be the one and only
> definition of "end to end security".
>
> Thus, you may get support for your real request, but not for the language
> you use to describe it.
>
>>
>> Until WebRTC security architecture specification does not clearly define
>> a peer-to-peer fingerprint verification system that does not rely on
>> trusted third party it cannot be considered to provide end-to-end
>> security.
>>
>> Fabio
>> _______________________________________________
>> rtcweb mailing list
>> rtcweb@ietf.org
>> https://www.ietf.org/mailman/listinfo/rtcweb
>
>
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb