Re: [rtcweb] I-D Action: draft-ietf-rtcweb-data-protocol-01.txt

[Paul Kyzivat <[e-mail]>]

(trimming)

On 10/29/13 2:46 PM, Eric Rescorla wrote:

>              Is it not possible for an intermediary on the signaling path to
>              insert itself in the media path, manipulating the SDP such
>         that the
>              two ends both establish the DTLS with the intermediary?
>
>         There is a separate role negotiation for DTLS (actpass, etc.)
>         that works
>         even if both sides think they are the offerer or answerer.
>
>
>     I know about that. That mechanism is also used for TCP negotiation
>     in SDP. And that is one place where an intermediary sometimes sticks
>     its nose in explicitly to manipulate the roles, allowing both ends
>     to be active.
>
>     In the current case, ICE and possible TURN result in getting the
>     media path established without those games. So maybe there is less
>     motivation for an intermediary. But still, they still seem to show
>     up because administrators think they need them. And once there,
>     couldn't the intermediary still end up making both ends think they
>     are active?
>
> Well, it could but then they wouldn't be able to negotiate DTLS.

Couldn't it negotiation independently on each side - becoming a true MITM.

(I'm not advocating this as a good thing. But if it is possible, there 
will be someone who wants to do it, and somebody willing to sell them 
stuff to do it.)

	Thanks,
	Paul