Re: [rtcweb] Resolving RTP/SDES question in Paris

[Roman Shpount <[e-mail]>]

On Fri, Mar 23, 2012 at 11:01 AM, Dan Wing <[e-mail]> wrote:

>
> 'Double encryption' is done because it's the only way to achieve
> security at various layers.
>
>
Probably a side note, but double encryption is often done since each
encryption layer serves completely different purposes.

In case of organizations that care about security of their communications
(such as NSA), it is not only the content of the communication, but the
fact that communication took place between certain parties is a secret. For
example, the fact that president is calling Israeli prime minister in the
middle of the night usually means that something significant is about to
happen and normally is a national secret, even if the content of such
conversation is unknown. To prevent eavesdropping on the communication
parties, some sort of VPN protocol such IPsec is used.

On the other hand, parties that are involved in the secure communication
need to confirm each others identities and ensure that only identified
parties will receive contents of the communication. This is insured by
HTTPS with SRTP in case of WebRTC, or by SIPS with SRTP in case of NSA
deployment.

Bottom line, in most cases double encryption is a required feature and not
a bug.
_____________
Roman Shpount