Re: [rtcweb] SRTP - mandatory to implement vs mandatory to use (Re: Let's define the purpose of WebRTC)

["Muthu Arul Mozhi Perumal (mperumal)" <[e-mail]>]

|At the moment, draft-ietf-rtcweb-rtp-usage does not contain any
|requirement on SRTP usage (the security section says "A mandatory 
|to implement media security solution will be required to be picked", 
|which I think is a bit weak), and the discussion at the time did not 
|seem to indicate consensus that SRTP must be used always, so I 
|decided to document what we seemed to have consensus on - that SRTP 
|MUST be implemented.

Does it mean:
a. The WebRTC browser MUST implement SRTP, but the WebRTC service/JS needn't use it OR
b. The WebRTC browser and the service/JS MUST implement SRTP, but the user needn't have to use it?

thanks,
Muthu

|-----Original Message-----
|From: [e-mail] [mailto:[e-mail]] On Behalf Of Harald Alvestrand
|Sent: Monday, November 07, 2011 2:37 PM
|To: José Luis Millán
|Cc: <[e-mail]>
|Subject: [rtcweb] SRTP - mandatory to implement vs mandatory to use (Re: Let's define the purpose of
|WebRTC)
|
|On 11/06/2011 10:16 AM, José Luis Millán wrote:
|> draft-ietf-rtcweb-overview-02 downgraded the SRTP concerns from
|> mandatory-to-use to mandatory-to-implement. So if it does not
|> downgrade anymore, a WebRTC implementation (game app, greeting cards
|> website..) will have to implement SRTP.
|>
|> IMHO, if a web service doesn't want to take, or cannot take, the hit
|> for SRTP, WebRTC is not the appropriate solution for such a service.
|>
|Forking this thread, since it's actually about a line in the documents....
|
|in draft-ietf-rtcweb-overview-02, I changed this section:
|
|5.  Data framing and securing
|
|    SRTP [RFC3550] is used for transport of all real-time media.
|
|    The detailed considerations for usage of functions from RTP and SRTP,
|    as well as for non-media real-time data, are given in <WORKING GROUP
|    DRAFT "MEDIA TRANSPORTS">.
|
|into this section:
|
|5.  Data framing and securing
|
|    The format for media transport is RTP [RFC3550].  Implementation of
|    SRTP [RFC3711] is required for all implementations.
|
|    The detailed considerations for usage of functions from RTP and SRTP
|    are given in [I-D.ietf-rtcweb-rtp-usage].  Key negotiation for SRTP
|    is described in <MISSING>.  Transfer of data that is not in RTP
|    format is described in <MISSING>.
|
|At the moment, draft-ietf-rtcweb-rtp-usage does not contain any
|requirement on SRTP usage (the security section says "A mandatory to
|implement media security solution will be required to be picked", which
|I think is a bit weak), and the discussion at the time did not seem to
|indicate consensus that SRTP must be used always, so I decided to
|document what we seemed to have consensus on - that SRTP MUST be
|implemented.
|
|If we have consensus to make it stronger again, I'm happy to change it back.
|
|                   Harald
|
|
|
|_______________________________________________
|rtcweb mailing list
|[e-mail]
|https://www.ietf.org/mailman/listinfo/rtcweb