Re: [rtcweb] SDP Security Descriptions (RFC 4568) and RTCWeb

[Tim Panton <[e-mail]>]

On 6 May 2013, at 15:30, Henry Lum wrote:

> Chiming in late.
> 
> Speaking from a contact center perspective, a lot of calls are required to be recorded. In order to allow active recording (such as SIPREC), the contact center has to provide a media endpoint for bridging media so that a copy of the media can be created. The users will have to trust the contact center to handle the media anyways, and the media must be decrypted and re-encrypted by some media element within the contact center to perform recording. To me DTLS-SRTP-EKT does not provide any additional benefit over SDES for this type of use case.

It can provide an identity benefit. A bank contact center can offer an x509 certificate (from a trusted CA) over the DTLS media stream. 
That's a big difference from the web server offering a cert over https - the channel that may be shared with the signalling channel, which in turn 
may have set up the media.

Direct assertion vs 2 uncertain hops.

Of course the utility of that depends on the combined UX of the browser chrome and the site, but at least it is possible...

There should perhaps be some extra chrome 'bling' if the cert that arrives over DTLS matches the HTTPS one that brought the signalling.

T.