Re: [rtcweb] Question about srtp_mki in DTLS/SRTP

[🔓Dan Wing <[e-mail]>]

On Jan 13, 2015, at 4:48 PM, Bernard Aboba <[e-mail]> wrote:

> A question about negotiation of the use of the SRTP MKI field in DTLS/SRTP. 
> 
> RFC 5764 Section 4.1.3 has this to say about negotiation of support for the SRTP MKI field in SRTP/SRTCP: 
> 
> 4.1.3.  srtp_mki value
> 
>    The srtp_mki value MAY be used to indicate the capability and desire
>    to use the SRTP Master Key Identifier (MKI) field in the SRTP and
>    SRTCP packets.  The MKI field indicates to an SRTP receiver which key
>    was used to protect the packet that contains that field.
> 
> Looking at draft-ietf-rtcweb-rtp-usage, draft-ietf-rtcweb-security and draft-ietf-rtcweb-security-arch, there is no additional mention of the SRTP MKI field.  
> 
> What can be concluded about negotiation and support for the SRTP MKI field within WebRTC implementations? 
> 
> Do existing WebRTC implementations have the capability to receive or send with the SRTP MKI field (e.g. if the peer implementation requests it?)
> 
> Do existing WebRTC implementations indicate a desire to use the SRTP MKI field? 
> 
> Does the IETF RTCWEB WG have any additional guidance to provide on this topic beyond what is in RFC 5764 Section 4.1.3?

The function of SRTP MKI overlaps with EKT (Encrypted Key Transport), and using both would significantly complicate EKT.  Thus, in EKT, we prohibit using MKI and EKT together.  EKT brings a lot of advantages to conferencing which cannot be achieved solely with MKI (no matter how MKI is signaled).  For WebRTC, I don't see SRTP MKI being used.

-d