Re: [rtcweb] Consensus call regarding media security

[Roman Shpount <[e-mail]>]

On Thu, Mar 29, 2012 at 11:21 AM, Iñaki Baz Castillo <[e-mail]> wrote:

> You miss something:
>
> 1) I access some web using HTTPS with a valid certificate and so.
>
> 2) Some HTML and JavaScript is got.
>
> 3) The JS code opens a *non* secure WebSocket connection to some other
> server (same domain or not, it does not matter here).
>
> 4) WebRTC signaling goes through the WebSocket connection (so forget
> the initial HTTPS hyper-secure-and-verified connection).
>
> 5) SDES-SRTP is negotiated and accepted by both peers.
>
> 6) So signaling can be intercepted (unsecure WebSocket connection),
> and therefore also the SDES keys. Interception possible regardless the
> initial communication was HTTPS.
>
> 7) FAIL.
>

First of  all, HTTP WebSocket connection are normally not allowed from
HTTPS initiated sessions (or generate a warning).

Second, my point was that SDES-SRTP is no more secure then plain RTP when
signaling is transmitted over clear channel. You are saying the same thing.
If SDES-SRTP is allowed, there is no harm in allowing plain RTP from HTTP,
since, as far as security is concerned, there is no difference.

> _____________
Roman Shpount