Re: [rtcweb] Security Architecture: SDES support is a MUST

On 07/20/2012 03:18 PM, Fabio Pietrosanti (naif) wrote:
> On 7/20/12 3:06 PM, Harald Alvestrand wrote:
>>> Current security definition of WebRTC does not support end-to-end
>>> security.
>> The current security definition of WebRTC (with DTLS) provides
>> fingerprints.
>> If the application is able to verify those fingerprints, security is end
>> to end; if it isn't - it isn't.
> The security specification already does specify how the fingerprint must
> be checked, against a third party system that must be trusted (unless
> there is some recent update i didn't still checked).
>
> The way the specification describe fingerprint must be checked, does not
> enforce end-to-end security but always rely on trusted third party,
> being IdP (identity providers).
>
> The only way to achieve end-to-end security is not to have any kind of
> trusted third party, as has been already discussed on
> http://www.ietf.org/mail-archive/web/rtcweb/current/msg04043.html .
That link is your request to have SAS considered mandatory.

I believe you got some support for that proposal, or at least some kind 
of availability of digest information that can be verified 
independently, but I do not believe that you got any support for having 
SAS be the one and only definition of "end to end security".

Thus, you may get support for your real request, but not for the 
language you use to describe it.
>
> Until WebRTC security architecture specification does not clearly define
> a peer-to-peer fingerprint verification system that does not rely on
> trusted third party it cannot be considered to provide end-to-end security.
>
> Fabio
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb