Re: [rtcweb] Traffic should be encrypted. (Re: Let's define the purpose of WebRTC)

[Eric Rescorla <[e-mail]>]

On Fri, Nov 11, 2011 at 4:02 AM, Roman Shpount <[e-mail]> wrote:
> On Fri, Nov 11, 2011 at 3:49 AM, Olle E. Johansson <[e-mail]> wrote:
o, I wanted expand on the debug requirements: I do hope we will make key
> exchange mechanism, different from SDES, mandatory for WebRTC. Passing
> actual encryption keys through JavaScript makes media encryption to easy to
> circumvent. This means some type of public/private key encryption used for
> key exchange. If we do this right, getting to the actual key used for media
> session encryption will be very difficult, so most of the tools currently
> used for SRTP debugging will stop working.

This simply isn't "very difficult". There are existing tools for doing SSL/TLS
diagnostics and for recovering the encrypted data (e.g., ssldump, wireshark)
and it's not going to be hard to adapt them to this application.


> One more benefit of having RTP as fallback for legacy interop is that it
> will allow us to specify something that will be more secure for WebRTC. If
> SDES support would no longer be needed, we can concentrate on using key
> exchange mechanism that is actually secure.

I think it's important to distinguish between legacy interop and WebRTC-WebRTC
cases. I'm more positive (though still not exactly thrilled) about the
claim that we
should support RTP for interop modes provided that WebRTC-WebRTC calls are
secure.


> Finally, (going slightly off topic here) it would probably be a good idea to
> make key exchange part of the initial ICE transaction. This way we can use
> this key exchange as an additional verification of the remote party, and
> reduce the number of round trips required before the media flow is
> established.

There's no real need for additional verification of the remote party at the ICE
level. My suspicion is that the RTTs won't be a significant factor here, but
certainly it would be possible to embed the DTLS messages into the
ICE exchange if it turned out to be.

-Ekr