IETF Logo Mail Archive

Re: [rtcweb] Consensus call regarding media security

Basil Mohamed Gohar <basilgohar@librevideo.org> Thu, 29 March 2012 15:30 UTC

Return-Path: <basilgohar@librevideo.org>
X-Original-To: rtcweb@ietfa.amsl.com
Delivered-To: rtcweb@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A158821E820E for <rtcweb@ietfa.amsl.com>; Thu, 29 Mar 2012 08:30:21 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.582
X-Spam-Level:
X-Spam-Status: No, score=-2.582 tagged_above=-999 required=5 tests=[AWL=0.017, BAYES_00=-2.599]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EuC88dTCzU96 for <rtcweb@ietfa.amsl.com>; Thu, 29 Mar 2012 08:30:20 -0700 (PDT)
Received: from mail.zaytoon.hidayahonline.net (zaytoon.hidayahonline.net [173.193.202.83]) by ietfa.amsl.com (Postfix) with ESMTP id C612B21E813B for <rtcweb@ietf.org>; Thu, 29 Mar 2012 08:30:20 -0700 (PDT)
Received: from [10.10.40.98] (rrcs-98-103-138-67.central.biz.rr.com [98.103.138.67]) by mail.zaytoon.hidayahonline.net (Postfix) with ESMTPSA id 183CF652674 for <rtcweb@ietf.org>; Thu, 29 Mar 2012 11:30:20 -0400 (EDT)
Message-ID: <4F748009.1000300@librevideo.org>
Date: Thu, 29 Mar 2012 11:30:17 -0400
From: Basil Mohamed Gohar <basilgohar@librevideo.org>
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.24) Gecko/20111108 Fedora/3.1.16-1.fc14 Lightning/1.0b3pre Thunderbird/3.1.16
MIME-Version: 1.0
To: rtcweb@ietf.org
References: <4F732531.2030208@ericsson.com> <101C6067BEC68246B0C3F6843BCCC1E31296C4CC7B@MCHP058A.global-ad.net> <CALiegfm-acB8vEJrC+TQwAX4a9UkE5TXcvsfb7XXPMW4SrNvBw@mail.gmail.com>
In-Reply-To: <CALiegfm-acB8vEJrC+TQwAX4a9UkE5TXcvsfb7XXPMW4SrNvBw@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
Subject: Re: [rtcweb] Consensus call regarding media security
X-BeenThere: rtcweb@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <rtcweb.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/rtcweb>
List-Post: <mailto:rtcweb@ietf.org>
List-Help: <mailto:rtcweb-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 29 Mar 2012 15:30:21 -0000

On 03/29/2012 11:23 AM, Iñaki Baz Castillo wrote:
> 2012/3/29 Hutton, Andrew <andrew.hutton@siemens-enterprise.com>:
>> I agree that there was clear consensus on mandating the use of SRTP but it was not clear to me what the consensus is regarding the use of SRTP with a null cipher. Does the statement "there was overwhelming consensus that all RTP packets SHALL be protected by SRTP" mean that the null cipher will not be allowed?
> IMHO it's very easy:
>
> - The JavaScript WebRTC API MUST NOT be able to set a null cipher (never).
>
> - The browser MAY include an option in about://config ("SRTP: user
> null cipher for debugging purposes").
>
> - Such an option is reverted (so dissabled) upon browser restart.
>
I think the standard need not specify that NULL cipher is allowed to
enable the debugging feature for browsers or other implementations. 
It's reasonable to assume that, when testing and debugging, one may
break the spec in the process.  Leaving it out of the standard is the
safest way to prevent it from being used in a production environment.

-- 
Libre Video
http://librevideo.org

v2.23.0 | Report a Bug | By Email