Re: [rtcweb] Consensus call regarding media security

[Iñaki Baz Castillo <[e-mail]>]

2012/3/29 Fabio Pietrosanti (naif) <[e-mail]>:
> From:
> http://datatracker.ietf.org/doc/draft-ietf-rtcweb-security-arch/?include_text=1
>
> "   The basic assumption of this architecture is that network resources
>   exist in a hierarchy of trust, rooted in the browser, which serves as
>   the user's TRUSTED COMPUTING BASE (TCB).  Any security property which
>   the user wishes to have enforced must be ultimately guaranteed by the
>   browser (or transitively by some property the browser verifies)."
>
> So, it means that if the browser already have a hierarchy of trust to
> use TLS for HTTPS, then SDES-SRTP will inherit the trust-properties of
> the HTTPS website from which it's loaded.
>
> It seems to me quite easy to fit SDES-SRTP into the browser model, as it
> allow you to assure that the communication path between the client and
> the server is secure.
>
> Do you expect WebRTC to be only peer-to-peer/client-to-client?
>
> I sincerly expect *a lot* of communications to goes trough SIP/RTP media
> proxy for security purpose, for billing purposes, for value added
> service purpose.
>
> SDES-SRTP provide a very reliable and simple way to let a WebRTC peer to
> establish security with the server, assuming that it already have
> established security trough HTTPS/TLS that's a consolidate trust method.

+2  (I don't use "+1" since I don't use Google+).

-- 
Iñaki Baz Castillo
<[e-mail]>