Re: [rtcweb] SRTP not mandatory-to-use

[Bernard Aboba <[e-mail]>]

Justin Uberti said:

"If we make SRTP mandatory to use, people will figure out a way to make SRTP work in their scenarios. If we don't, people will continue to use the same old objections as to why they can't deploy SRTP.


SRTP isn't a panacea, but I think we have a chance to take a big step forward here."

[BA] In practice, the details of precisely how this is implemented make a difference. 

For example, it is quite different to require SRTP in all circumstances, versus say, recommending that SRTP be preferred by default but allowing RTP to be negotiated (via RFC 5939 or simple fallback).  

Requiring SRTP in all circumstances (e.g. offering RTP/SAVP(F) and not falling back or allowing negotiation of RTP/AVP(F)) would not preclude gateways from translating to RTP/AVP(F), without user knowledge.  

This would result in an illusion of security, compared with an actual negotiation which would apprise the user as to whether security is actually in place.