[rtcweb] Final plea about SRTP

[Roman Shpount <[e-mail]>]

I know there was a consensus call on this list that SRTP shall be used for
all the calls in WebRTC, but I still do not understand the justification
for this requirement for WebRTC applications delivered over HTTP with no
identity. For such scenarios SRTP (even DTLS-SRTP) serves almost no
purpose. If application is delivered over HTTP attacker can spoof the
entire web site. It is trivial if the attacker is on the communications
path. If attacker is seating in the airport using the same network, it can
put itself on the communications path using arp cache poisoning. Once the
web site is spoofed, any type of man in the middle attack can be
implemented. If DTLS-SRTP is used user can detect the attack by checking
the key signature, but in reality very few people will do this.

The main argument to require SRTP everywhere was that it does not break
anything. But neither would naming all the API methods in High Elfish.
Either requirement does not break things, but make working with WebRTC
harder then it should. At the same time both of those requirements are
completely unjustified.

Furthermore, assumption on this list that most of the WebRTC use would be
peer-to-peer communications between browsers with all the rest of the
communication modes, such as calling automated services or PSTN being
insignificant. I simply do not agree to this point of view. I expect that
communication with automated services, such as video greeting cards or
voice blogging, would be a significant portion of WebRTC user base. If such
automated service is deployed as a plain HTTP web site, it should be able
to communicate with web browsers using RTP. SRTP in such case would serve
no purpose.

Finally, requiring secure communications for everything is going against
the way most of the web works. Most of it is not secured and only requires
secure communications when secure (HTTPS) web site is accessed. I think it
should be the same for WebRTC, with DTLS-SRTP required when connected to
HTTPS web site and plain RTP allowed when connected to plan HTTP.
_____________
Roman Shpount