Re: [rtcweb] SRTP not mandatory-to-use

[Alan Johnston <[e-mail]>]

Here is the problem - allowing RTP opens up WebRTC to a bid down
attack on media security.  There are few good ways to prevent this bid
down attack, and none of them work given the lack of standardization
and control over WebRTC signaling.

Also, allowing both RTP and SRTP is a user interface nightmare for the
browsers.  They have had all kinds of problems in the past with simple
HTTP/HTTPS, and this will be even uglier.

Mandating SRTP avoids both these problems.

- Alan -

On Wed, Jan 4, 2012 at 4:28 PM, Roman Shpount <[e-mail]> wrote:
>> Justin Uberti said:
>>
>> "If we make SRTP mandatory to use, people will figure out a way to make
>> SRTP work in their scenarios. If we don't, people will continue to use the
>> same old objections as to why they can't deploy SRTP.
>>
>>
>
> I thought our goal is to design a web based real time communication network
> with the widest possible set of capabilities. I never thought that the goal
> of this group is to promote other architectural agendas, even the ones as
> such as spreading communications security. Security of communications would
> be defined by the application developer. If application developer designs
> something that is meant to be insecure (like place all calls through a
> middle server that will record everything and publish it on an open web
> site), it would be. I do not understand why application developer with
> WebRTC should not have an option to communicate without SRTP. Ability for
> developer to specify that RTP is allowed for certain connection takes
> nothing from security of WebRTC, and makes a lot of issues (such as interop,
> getting initial application developed and tested, etc) a lot simpler.
>
> I do believe that SRTP CPU load argument is nonsense (especially with newer
> CPUs where there is hardware AES offload), but I the only argument I heard
> so far for mandatory SRTP use was that future WebRTC developers are so
> incompetent and ignorant that they will never use SRTP unless we force them.
> Make it simple to specify that SRTP is required via an API, make it default,
> and developers will use it. As long as WebRTC connection does not
> automatically fall back to RTP if SRTP connection is required and cannot be
> established, I simply don't see what the problem is.
> _____________
> Roman Shpount
>
> _______________________________________________
> rtcweb mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rtcweb
>