Re: [rtcweb] Let's define the purpose of WebRTC

[Hadriel Kaplan <[e-mail]>]

On Nov 9, 2011, at 10:05 AM, Iñaki Baz Castillo wrote:

> Implementing SRTP is really easier and cheap. There is no reason at
> all not to mandate it in a new specification, even less when it's
> designed to work in the open (and untrusted) Internet.
> 
> So bad luck. You, telcos, have the specs and the tools to upgrade your
> non-secure SIP devices. Do it.

Several people have made this SRTP discussion into a "Telco" issue, and I don't think it is.  First, because if a Telco doesn't care about securing the media, they'll likely put the burden of making it plaintext RTP on the WebRTC domain owner, so it still won't be "their problem".  But more importantly, because I expect a lot of Telco's to actually *require* WebRTC media communications to/from them be secure in some fashion or other, specifically because it can be run to/from anywhere on the public Internet. [they won't do SRTP all the way to their own SIP endpoints, but that doesn't matter]  

So for Telco's I don't think mandating SRTP be used is a non-starter, though the form of key exchange might be a big sticking point.

But something to consider is if doing SRTP is a burden or not on web applications that know a priori that they don't need it.  In particular I mean ones that need to use media servers so it's not simply browser-to-browser, and they use HTTP because their use-case isn't one of a sensitive nature.  

-hadriel
p.s. BTW, I didn't mean to start a religious war on this topic - I was just pointing out that a requirement to use ICE and a requirement to use SRTP aren't tied together, and that we need to still get consensus on mandating SRTP to-use vs. only to-implement.