Re: [rtcweb] Retransmit: Summary of Alternatives for media keying

[Randell Jesup <[e-mail]>]

On 7/29/2011 1:12 AM, Matthew Kaufman wrote:

>>> (You can also add a browser extension that uses a service that you trust but that isn't your calling service, and when you're calling other people with the same extension you can check the fingerprints in an automated way using that.)
>> Definitely possible, and adds another largely-independent layer of trust.
> Yes, but independent layers of trust are a feature, not a bug.
>
> And what are you arguing here? My claim is that DTLS-SRTP is often *more* secure than SDES-style keying, and certainly no worse.

No disagreement at all.   I'm discussing that DTLS-SRTP is vulnerable 
(to a degree) to MITM
attacks, which is well-known, if you don't have a known-secure signaling 
channel.  I'm not making the
argument that Hadriel is.

>>> If you *don't* trust your "calling service", then that's just like not trusting your banking service when you type in passwords.
>> I may trust my calling service to connect me (to someone), but I may not trust them to not MITM me themselves (read CALEA or other national security services), and I may not trust them not to be compromised, since they have a far smaller monetary stake in avoiding it compared to a bank.
> Sure, but again all of these things are EASIER if they use SDES. They can MITM you themselves by letting anyone get a copy of the traffic from anywhere and sending that person the keys, even after the fact. (Both passive attacks like this and getting the key later are prevented with DTLS-SRTP and DH key agreement).

Absolutely.

> Another idea related to identity: as mentioned, the cert trust chain in a browser verifies that you're talking to mybank.com or myprovider.com.  This can be leveraged to provide authentication by cert that you're talking to someone who's part of mybank.com, even if you went through myprovider.com to get there and myprovider.com might be compromised.  It doesn't directly help verify you're talking to Joe Your Neighbor, but other services can help with that (as mentioned - extensions, etc).
> Yes, all good ideas, but built upon DTLS-SRTP, and not SDES or plain RTP.

Yes, that's the idea.

>> Effectively, for a fairly large subset of the net, we have a deployed PKI of a form.  It's not perfect (DNSSEC anyone; recent todo with bogus certs because a CA snafu) but for most uses that it covers it's pretty good.  Getting it to cover identifying the destination as a dependent of the primary cert may be an issue for many companies, however.
> I doubt it, but perhaps.

My concern was getting companies to deploy subsidiary certs to the 
browsers of call center agents, etc
(especially as these functions are often out-sourced).

>> In any case, there may be a way to leverage this existing trust chain, both to authenticate who's calling you and who you're calling, for a subset of possible destinations.
> Almost certainly.

Good!

-- 
Randell Jesup
[e-mail]