Re: [rtcweb] SRTP and "marketing"

Gregory Maxwell <> Fri, 30 March 2012 15:39 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 2756C21F86D1 for <>; Fri, 30 Mar 2012 08:39:29 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -6.524
X-Spam-Status: No, score=-6.524 tagged_above=-999 required=5 tests=[AWL=0.075, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id tfCB0QAKQIPS for <>; Fri, 30 Mar 2012 08:39:28 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id 7F64C21F86D0 for <>; Fri, 30 Mar 2012 08:39:28 -0700 (PDT)
Received: from ([]) (using TLSv1) by ([]) with SMTP ID DSNKT3XTrk5eje+ekmRSX7KPy9HZW/; Fri, 30 Mar 2012 08:39:28 PDT
Received: from ([fe80::c821:7c81:f21f:8bc7]) by ([fe80::fc92:eb1:759:2c72%11]) with mapi; Fri, 30 Mar 2012 08:37:57 -0700
From: Gregory Maxwell <>
To: Randell Jesup <>, "" <>
Date: Fri, 30 Mar 2012 08:37:57 -0700
Thread-Topic: [rtcweb] SRTP and "marketing"
Thread-Index: Ac0N903AuI/AsopKSqCZGCBYPaD84QAjG+ne
Message-ID: <>
References: <> <> <> <>, <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Subject: Re: [rtcweb] SRTP and "marketing"
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Fri, 30 Mar 2012 15:39:29 -0000

Randell Jesup [] wrote:
> That's not of no benefit. It's not of real
> benefit to J. Random Salesman, but even non-political people may worry
> about someone watching in more than they worry about listening in.
> (#include lawsuits over schools using laptop computers to take snapshots
> from student computers at home, etc, etc).

A point which needs to be emphasized is that undetectable attacks are
not at all the same thing as detectable attacks: Even when the chance
of detection is somewhat low, if the cost of detection is high the
possibility of it can be an effective deterrent.

Assuming 'hardcoded' ephemeral key agreement, Users Comparing
Tools->PageInfo->Media->session fingerprint — especially if documented
as a best practice in HowToBeParanoid documents— would be likely to
detect network level mass interception, even if the chance of detection
on a case by case is very low.  This makes the development and deployment
of _covert_ mass surveillance/censorship infrastructure, the sort with
the greatest negative human rights value, less attractive from a cost
benefit perspective.

(Of course, it does nothing for non-secret monitoring— but when the
monitoring is not secret the users of protcol have the most important
information they need in order to make an informed choice about how
they communicate, what public policies they live under, who they have
providing their network services, etc)

In computer and cryptographic security we're often concerned with absolute
protection. This is because absolute security is often achievable in this
area,  a luxury few other kinds of security have. But where absolute
security can't be provided (e.g. we _can't_ prevent MITM without hard to
provide and often missing identity service), relative security still has
value. When considering the real world context of attacks always being
a cost benefit trade-off the removal of nearly-undetectable attacks is as
an enormous relative improvement as is the removal of passive sniffing.