Re: [rtcweb] SRTP DTLS - SIPit

["Olle E. Johansson" <[e-mail]>]

12 jan 2012 kl. 00:14 skrev Justin Uberti:

> The SIPIt reports note progress on SDES implementation, but DTLS/SRTP
> not so much, and integrating DTLS/SRTP within RTCWEB would require more
> work beyond what is available in SIP DTLS/SRTP implementations today. 
> As a result, I am more inclined toward Justin's proposal for RTCWEB v1.0
> (assuming that the questions are answered). 

When asking implementers at SIPit I have gotten a lot of people pointing to not ready implementations in GnutTLS and OpenSSL (still in beta). Talking with an OpenSSL developer a few days ago, I was clearly informed that OpenSSL DTLS support is ready for implementation, no reason to wait.

Another reason I heard mostly from hardware device vendors was that the chips vendors lack support of DTLS.

I think it's mostly a question of lack of customer demand. If people realize that the encryption keys are more or less distributed without control with SDES, this will not be accepted. A secure IP-telephony project in germany went for ZRTP because they could not accept SDES and hardware phone vendors did not want to fix DTLS even if they was offered orders of a quantity of phones...

With all the implementations listed in this thread I think we can have successful tests of DTLS-srtp at the next SIPit event. Remember that we had very few participants at SIPit in Monaco, so using that report as statistical evidence is propably not a good thing.

/O