Re: [rtcweb] End-to-end encryption vs end-to-end authentication (DTLS-SRTP / SDES-SRTP)

[Roman Shpount <[e-mail]>]

On Thu, Apr 5, 2012 at 2:10 PM, Fabio Pietrosanti (naif) <
[e-mail]> wrote:

> On 4/5/12 7:42 PM, Roman Shpount wrote:
> >
> > On Thu, Apr 5, 2012 at 1:07 PM, Fabio Pietrosanti (naif)
> > <[e-mail] <mailto:[e-mail]>> wrote:
> >
> >     This means that DTLS-SRTP, from a trust-model point of view, does not
> >     provide end-to-end security because there will always be a trusted
> third
> >     party able to authorize Man in the Middle to do eavesdropping.
> >
> >
> > Incorrect. If fingerprint is exposed and can be verified, DTLS-SRTP does
> > provide end-to-end security. No third parties involved.
>
> No, you are wrong in the understanding.
>
> The fingerprint is always delivered from the signaling services, so by
> the HTTPS website providing the JS calling application.
>
> If fingerprint is exposed to the user and be compared through some
alternative communications channel, the it can provide an independent
security validation similar to the one used in ZRTP. If signaling server
replaces the fingerprint for some sort of attack this can be detected, even
though it can be argued that very few people will do so.
______________
Roman Shpount