Re: [rtcweb] No Interim on SDES at this juncture

[Martin Thomson <[e-mail]>]

On 13 June 2013 20:39, Hadriel Kaplan <[e-mail]> wrote:
>> My impression from Paris was that if the WebRTC world supports EKT, then gatewaying into an SDES realm requires some fancy key-shuffling, nothing more.
>
> My impression from the discussion there was: "we have this new shiny toy no one's ever deployed so why don't we use you as the guinea pig".  In fact if I recall correctly it was you who said something along those lines in Paris. :)

Likewise.  I also wonder what the API surface for this feature needs
to look like.  Clearly, someone needs to decide to push new keys into
the session, but can that be the application: is this something that
would have an API in the browser?

(That's a serious question, BTW.  Comment 22 provided that interface,
because we wanted to support SDES and the same interface conveniently
applies to EKT, but that leads to some interesting issues with respect
to media security.)

As I see this issue, it's a not a matter of "do we need SDES in
addition to DTLS-SRTP", it's more a matter of "how do we solve the
my-MCU-is-on-fire problem", for which there are two proposals on the
table: SDES and EKT.  The latter has some issues with respect to
deployment, even if it has some merits from a security perspective.
There are other reasons that SDES is preferable to us, though those
might not be compelling to others, but I can't get over this central
issue.