Re: [rtcweb] SRTP - mandatory to implement vs mandatory to use (Re: Let's define the purpose of WebRTC)

[Harald Alvestrand <[e-mail]>]

On 11/10/2011 08:39 AM, Muthu Arul Mozhi Perumal (mperumal) wrote:
> |At the moment, draft-ietf-rtcweb-rtp-usage does not contain any
> |requirement on SRTP usage (the security section says "A mandatory
> |to implement media security solution will be required to be picked",
> |which I think is a bit weak), and the discussion at the time did not
> |seem to indicate consensus that SRTP must be used always, so I
> |decided to document what we seemed to have consensus on - that SRTP
> |MUST be implemented.
>
> Does it mean:
> a. The WebRTC browser MUST implement SRTP, but the WebRTC service/JS needn't use it OR
> b. The WebRTC browser and the service/JS MUST implement SRTP, but the user needn't have to use it?
>
For this group: a, I think.

I haven't seen it realistic to impose restrictions in RTCWEB on the 
Javascript that people write.
The language and the APIs are subjects of standardization; the code 
written isn't.

If someone claims to implement a protocol in Javascript, of course the 
restrictions apply - if they implement a protocol in Javascript where 
crypto is mandatory to implement, and don't implement crypto, their 
claim to have implemented the protocol is false advertising.

But the IETF has no protocol police.