Re: [rtcweb] No Interim on SDES at this juncture

[Michael Procter <[e-mail]>]

On 18 June 2013 22:16, Matthew Kaufman (SKYPE)
<[e-mail]> wrote:
> Your diagram is missing the part where the browser either learns the key
> that it is supposed to ask EKT to set or tells your SIP/SDES side what
> key it set using EKT. Either way, those keys go over HTTPS to/from the
> browser, yes?

I don't understand this part of your argument.  I was under the impression that
using DTLS-EKT meant we could avoid having keying information visible to
Javascript in the browser whilst still interoperating with legacy SRTP UAs that
determine their own transmission keys.

In your example, I thought it would work like this:

your PBX <-(SDES in SIP)-> my sip server <-(??)-> my media relay
<-(DTLS-EKT)-> browser

The PBX chooses its transmission key, and advertises it through
SDES/SDP.  The browser chooses its transmission key and advertises it
through DTLS-EKT. The media gateway has the job of matching up the
SDES pieces with the EKT pieces, and thereafter forwarding packets.

Yes, there is some call control coordination to do between the web server
and the sip server/media relay, but no keying information needs to pass to
the web server, nor on to the Javascript running in the browser.

Have I missed a use-case?  Is there a requirement to set the browser's
transmission key to a specific value (in which case, you are correct that
it would have to pass over HTTPS at least) too?

Regards,

Michael