Re: [rtcweb] Traffic should be encrypted. (Re: Let's define the purpose of WebRTC)

["Olle E. Johansson" <[e-mail]>]

10 nov 2011 kl. 23:07 skrev Roman Shpount:

> 
> 
> On Thu, Nov 10, 2011 at 4:37 PM, Harald Alvestrand <[e-mail]> wrote:
> So far, we've heard arguments that:
> 
> - encryption uses more CPU (true, but arguably not significant compared to media processing)
> - It is needed for legacy interoperability (may be true for some, but not necessarily compelling)
> - It helps debugging (which has been disputed by people who debug systems)
> 
> Did I miss some?
> 
> 
> Encryption being illegal in some situations is yet another reason (I know about the IETF position on wiretapping, but I would still argue that this is a valid reason.)
> 
> Higher barrier to entry for building new services -- for instance if you are building a media server to work with WebRTC client. Having one more thing to implement before something works is not critical, but makes a difference.

If you support DTMF in RTP you already have a requirement that you SHOULD  only do that over SRTP. If rtcweb supports telephony-events, we are already on the SRTP side as almost mandatory. I think it's easier to reach an agreement on SRTP being mandatory than DTMF being dis-allowed.


Appendix A of RFC 4733:
"The Security Considerations section is updated to mention the
   requirement for protection of integrity.  More importantly, it makes
   implementation of SRTP [7] mandatory for compliant implementations,
   without specifying a mandatory-to-implement method of key
   distribution."

"The telephone-event payload defined in this specification is highly
   compressed.  A change in value of just one bit can result in a major
   change in meaning as decoded at the receiver.  Thus, message
   integrity MUST be provided for the telephone-event payload type.

   To meet the need for protection both of confidentiality and
   integrity, compliant implementations SHOULD implement the Secure
   Real-time Transport Protocol (SRTP) [7]."

Section 6 of RFC 4733 - an RFC that makes 2833 obsolete.


/O