Re: [rtcweb] SBC hardware and SHA1

"Olle E. Johansson" <> Fri, 30 September 2011 18:54 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id BE73121F8A4E for <>; Fri, 30 Sep 2011 11:54:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.235
X-Spam-Status: No, score=-2.235 tagged_above=-999 required=5 tests=[AWL=0.014, BAYES_00=-2.599, HELO_EQ_SE=0.35]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id BtcYKThuq68D for <>; Fri, 30 Sep 2011 11:54:12 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 2C1D321F8880 for <>; Fri, 30 Sep 2011 11:54:12 -0700 (PDT)
Received: from [] ( []) by (Postfix) with ESMTPA id 5F5B6754BCE4; Fri, 30 Sep 2011 18:57:03 +0000 (UTC)
Mime-Version: 1.0 (Apple Message framework v1244.3)
Content-Type: text/plain; charset="us-ascii"
From: "Olle E. Johansson" <>
In-Reply-To: <>
Date: Fri, 30 Sep 2011 20:57:03 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
References: <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <> <C3C7D62E-6BA8-43F4-A29D->
To: Hadriel Kaplan <>
X-Mailer: Apple Mail (2.1244.3)
Cc: "<>" <>
Subject: Re: [rtcweb] SBC hardware and SHA1
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 30 Sep 2011 18:54:12 -0000

30 sep 2011 kl. 18:39 skrev Hadriel Kaplan:

> On Sep 30, 2011, at 2:36 AM, Olle E. Johansson wrote:
>> Hadriel,
>> While on the topic of the hardware, I would like to ask how these systems handle DTLS and SRTP.
> Assuming you mean terminating the SRTP, I only know of one hardware-based SBC that claims support for terminating DTLS-SRTP, but I don't know if it's real or slideware.  I know of a couple software-based ones that do. (you can probably google it to find out who)
> But in general the most popular support by far is for SDES-based keying.  There are a couple of off-the-shelf chip solutions for large-scale SRTP that handle it as a bump-in-the wire, but they need to be told the keys per stream and don't handle DTLS inline themselves to do so, so naturally SDES made it a lot easier to use them.  Having said that, I do believe that more SBC vendors in the US market will be supporting DTLS-SRTP in the future because the US government has it mandated in some agency or other I've been told.  Whether other governments will do the same I don't know. (then again the US government mandates a lot that never gets used in practice)
> Also, someone asked on this list if SBC vendors support SRTP to begin with.  Almost every SBC vendor I know of does support SRTP (at least with SDES keying), but it usually costs more to do so, because it's done in dedicated hardware.  So most deployed SBC systems don't do SRTP, because the people buying/deploying them have decided they don't need it and don't want to pay for it.  It's more popular in specific vertical markets, but overall it's definitely a minority today.

I heard from another hardware vendor about the issues with DTLS and hardware chips. Thanks for confirming that.