Re: [rtcweb] No Interim on SDES at this juncture

[Michael Procter <[e-mail]>]

On 19 June 2013 14:46, Bernard Aboba <[e-mail]> wrote:
> Michael said:
>>
>> The PBX chooses its transmission key, and advertises it through
>> SDES/SDP. The browser chooses its transmission key and advertises it
>> through DTLS-EKT. The media gateway has the job of matching up the
>> SDES pieces with the EKT pieces, and thereafter forwarding packets.
>
> [BA] Since the PBX can only handle SDES, and the media server speaks
> DTLS/SRTP-EKT,  the media server needs to provide the DTLS/SRTP-EKT
> key to the SIP server so that it can be signaled to the PBX within SDES/SDP.
> Similarly, the SIP server needs to provide the SDES key signaled by the
> PBX to the media server so that it can communicate this in DTLS/SRTP-EKT.
> Therefore the PBX, media server, SIP server and browser endpoint
> end up possessing the keys, which is less than ideal.

Well indeed.  The point I was querying was Matthew's assertion that the keys
also needed to be available to the web server and the Javascript app in the
browser (and hence transferred over HTTPS), for both SDES and EKT approaches.

I don't see why this should be true for EKT, which therefore
highlights a fairly
significant (IMHO) difference in the security properties of an
EKT-based solution.

I'm not currently claiming a preference for one over the other, but I think this
difference should be considered in the context of the whole picture.

Regards,

Michael