Re: [rtcweb] RTP-IPSec vs SRTP-DTLS [was RE: Resolving RTP/SDES question in Paris]

[Roman Shpount <[e-mail]>]

The reason is quite simple actually -- it is quite difficult to confirm
that IPSec is actually present. So browser has no way to determine that it
communicating over IPSec or plain IP.

On the other hand, I actually agree that if we are dealing with an
application on a private IP (like 10.X.X.X) you should be allowed to do
whatever you want. This is why I am proposing to support RTP for
applications delivered over HTTP. If you are in completely secure
environment and you do not want to do encryption, there is no reason why
the application should be delivered over HTTPS. If application is delivered
over HTTP, you either do no care about security (you are calling a public
radio) or security is provided by something else (you are sitting in the
bunker on the network not connected to the internet).

The large contingent of people on this list are convinced that upsides
(security) of requiring encryption outweigh downsides. The mentioned
downsides are:
1. Extra resource requirements. This is not really important as far as I am
concerned. New Xeon server can encrypt 39.7 GB/sec (
http://www.theregister.co.uk/2012/03/06/intel_xeon_e5_launch_event/)
2. Support for legacy devices. Also not as important since most legacy
devices will require a media proxy to support ICE anyway
3. Barrier to entry to develop new services. It is harder to debug and
develop new products if you need to develop larger number of protocols at
once. The understanding is that web browser will include some sort of
hidden setting that will allow plain RTP for debugging and development.
4. Encryption can be illegal or not allowed in some places, such as
military or prisons. Proposal is to enable some sort of configuration in
the web browser that will force it to send all the media through some sort
of recording/monitoring proxy.

While, as far as I am concerned, all of those arguments are addressed, my
main argument against requiring encryption is that there are scenarios when
it is not needed and not actually provided, primarily when application is
delivered over HTTP. All I am saying that if application developer does not
care about security, the application most likely would not be secure,
regardless of what we do. So why force it? Unless developer takes an effort
to buy an SSL certificate and deploy an app on a secure server, or gets the
certificate and sets up an identity provider, communication is not going to
be secure. If I am a high school kid trying to play with real time
communications using a free web hosting provider, I do not care about
security. All I care is that I can write something that makes a call. What
we are effectively doing is making this much more difficult. Innovation
does not have to come from serious projects created for serious purposes.
It often comes from things that are cobbled together and I want us to
enable this, unless it actually breaks something. I want to make WebRTC
easier to play with and hope that new exciting things will come out of this.
_____________
Roman Shpount


On Mon, Mar 19, 2012 at 9:53 PM, Ravindran, Parthasarathi <
[e-mail]> wrote:

> Hi all,
>
> Could you please let me know the reason why SRTP-DTLS alone MUST be
> supported by WebRTC web-browser and why not RTP-IPSec. In case my device
> support IPSec for all application, why web-browser has to mandated for
> double encryption. Another assumption here is that web-browser is endpoint
> (commercial browsers like chrome) which is not required as access entity
> (like Enterprise access router, SBC) shall acts as web-browser. So,
> web-browser point-to-point connection may be between employee browser to
> Enterprise access entity which is not required to be mandated as SRTP-DTLS.
> Hadriel mentioned large set of call centre solution wherein web-browser is
> just the endpoint, one way to access call centre and there is no need to
> change whole call centre architecture for the same WebRTC technology in
> case RTP-IPSec is supported by WebRTC browser running in IPSec mobile
> phone. I disagree with security advocates that all call centre using RTP
> will be broken as this security story does not sell well in the industry so
> far.
>
> Also, It is impossible to have the common UI by all web-browser and IETF
> specification should not try to find the way to solve that issue.
>
> My problem is not mandatory to implement SRTP-DTLS but the issue is at
> mandatory to use. IMO, RTP-IPSec should be allowed with user-consent in
> web-browser and don't argue that all web user in the world are dumb. In
> case the usecase is missing for RTP-IPSec as Randell mentioned, let us
> discuss in IETF-83 RTCWeb meeting.
>
> Thanks
> Partha
>