Re: [rtcweb] WebRTC-SIP interop: and why SDES-SRTP is a need

[Roman Shpount <[e-mail]>]

On Thu, Apr 5, 2012 at 1:42 PM, Randell Jesup <[e-mail]>wrote:

> However, the bar for introducing Yet Another Key Exchange Protocol at this
> late date is pretty darn high, unless it's amazingly simple (and likely
> insecure or with other unwelcome properties) or a modification of an
> existing protocol.
>
> My issue is that patching DTLS-SRTP also comes with a fairly high cost now
and for the foreseeable future, since each of the patches will require an
independent interop. We either need to define and make all of those patches
a requirement, or each end point communicating with WebRTC will need to
verify if public-key exchange is supported, if ICE key exchange is
supported , and such. Each option provides a different key exchange path,
which would be a challenge for interop and provide a potential attack
vector (from my experience, protocols with a lot of complex scenarios
serving the same purpose are typically easier to break into).


> I strongly dislike SDES for a number of reasons - not solely that the key
> is exposed to the server (as in the server/app may be evil or hacked), but
> exposure of the keys will likely engender requirements from authorities to
> record keys to allow for later decryption of media. That's a direct threat
> to privacy (especially given many organizations willingness to provide
> access without legal orders).  Also, once those keys are recorded, the
> database of such keys becomes a tempting target in of itself (though it's
> only of use to someone tapping the raw packets, which limits the exposure -
> governments generally have no problem getting that; individuals have more
> problems (but can)).  And as mentioned earlier, it makes the servers much
> more of a target for hacking and requests/orders from authorities.
>

I dislike SDES for being a "somewhat secure" protocol. This is a very
dangerous territory where end user is under impression of being protected,
but reality is different. IMHO, in such situations it is better to have no
security at all, so that users know not to do anything they will regret.
______________
Roman Shpount