Re: [rtcweb] Require/Suggest AEAD GCM for SRTP

Hi,

I think there’s general consensus that we should be updating the algorithm requirements every couple of years after the specifications are published.  But, we have not yet actually published cluster 238 yet.  We need to get that done first and then we should entertain updates; it is never as easy as one thinks it is to update the MTIs.

spt

> On Jul 11, 2019, at 03:22, Harald Alvestrand <harald@alvestrand.no> wrote:
> 
> Once cluster 238 is published, I'm in favor of looking at the
> mandatory-to-implement ciphersuites in RTCWEB and consider updating
> them. It's been a few years since we went through that exercise.
> 
> I am not in favor of proposing changes to the current documents.
> 
> Den 10.07.2019 20:06, skrev Sean DuBois:
>> Hello,
>> I am Sean DuBois, I work on Pion [0] a 100% Go implementation of
>> WebRTC. I have a user that is trying to do a large deployment, and
>> performance is very important to them. They see a 10x performance
>> improvement when using AEAD GCM for SRTP (thanks to HW acceleration)
>> and is the most obvious improvement we can make.
>> 
>> Having this would be a pretty fantastic improvement for very little
>> work. Especially for weak devices/scaling servers, AES-NI is a huge
>> deal. Also great for security, avoids possible timing attacks from
>> software implementation and just less for developers can mess up when
>> implementing SRTP themselves!
>> 
>> This also should be pretty painless change.
>> * FireFox already supports it
>> * Chromium is just behind a flag [1]
>> * Most other implementations also use libsrtp (where it is already available)
>> * Adding more protection profiles will have zero impact if they aren't
>> supported.
>> 
>> ----
>> I have never been involved with the IETF before, but this seems the
>> best way to push implementations to support it.
>> 
>> [0] https://github.com/pion/webrtc
>> [0] https://bugs.chromium.org/p/chromium/issues/detail?id=713701#c20
>> 
>> _______________________________________________
>> rtcweb mailing list
>> rtcweb@ietf.org
>> https://www.ietf.org/mailman/listinfo/rtcweb
>> 
> 
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb