Re: [rtcweb] SBC hardware and SHA1

["Olle E. Johansson" <[e-mail]>]

30 sep 2011 kl. 18:39 skrev Hadriel Kaplan:

> 
> On Sep 30, 2011, at 2:36 AM, Olle E. Johansson wrote:
> 
>> Hadriel,
>> While on the topic of the hardware, I would like to ask how these systems handle DTLS and SRTP.
> 
> Assuming you mean terminating the SRTP, I only know of one hardware-based SBC that claims support for terminating DTLS-SRTP, but I don't know if it's real or slideware.  I know of a couple software-based ones that do. (you can probably google it to find out who)
> 
> But in general the most popular support by far is for SDES-based keying.  There are a couple of off-the-shelf chip solutions for large-scale SRTP that handle it as a bump-in-the wire, but they need to be told the keys per stream and don't handle DTLS inline themselves to do so, so naturally SDES made it a lot easier to use them.  Having said that, I do believe that more SBC vendors in the US market will be supporting DTLS-SRTP in the future because the US government has it mandated in some agency or other I've been told.  Whether other governments will do the same I don't know. (then again the US government mandates a lot that never gets used in practice)
> 
> Also, someone asked on this list if SBC vendors support SRTP to begin with.  Almost every SBC vendor I know of does support SRTP (at least with SDES keying), but it usually costs more to do so, because it's done in dedicated hardware.  So most deployed SBC systems don't do SRTP, because the people buying/deploying them have decided they don't need it and don't want to pay for it.  It's more popular in specific vertical markets, but overall it's definitely a minority today.

I heard from another hardware vendor about the issues with DTLS and hardware chips. Thanks for confirming that. 

/O