Re: [rtcweb] Retransmit: Summary of Alternatives for media keying

[Hadriel Kaplan <[e-mail]>]

On Jul 29, 2011, at 10:30 AM, Matthew Kaufman wrote:

>> What I said to start this whole thing was: the two alternatives should not be described as choosing between secure and insecure.  BOTH alternatives require the user to verify something for the call to be secure.  BOTH alternatives have the potential to be very secure.  That is all.
> 
> I suppose that depends on what you mean by "the potential to be very secure"... certainly plain RTP *might* be secure, if it never leaves your desktop.

Yeah I should have clarified.  I meant since the alternative of DTLS+SDES+RTP includes DTLS-SRTP, and the human can verify it, and I assume DTLS-SRTP would always be preferred... then it has the potential to be very secure. (namely if DTLS-SRTP is used and the human verifies it)

In other words, both Alternative A and B have the ability to use DTLS-SRTP in the same way.  The only difference is Alternative A (DTLS only) would fail if trying to talk to someone who can't do DTLS-SRTP.  Alternative B would still succeed in letting people talk.

-hadriel