Re: [rtcweb] I-D Action: draft-ietf-rtcweb-data-protocol-01.txt

[Eric Rescorla <[e-mail]>]

On Tue, Oct 29, 2013 at 11:59 AM, Paul Kyzivat <[e-mail]>wrote:

> (trimming)
>
>
> On 10/29/13 2:46 PM, Eric Rescorla wrote:
>
>               Is it not possible for an intermediary on the signaling path
>> to
>>              insert itself in the media path, manipulating the SDP such
>>         that the
>>              two ends both establish the DTLS with the intermediary?
>>
>>         There is a separate role negotiation for DTLS (actpass, etc.)
>>         that works
>>         even if both sides think they are the offerer or answerer.
>>
>>
>>     I know about that. That mechanism is also used for TCP negotiation
>>     in SDP. And that is one place where an intermediary sometimes sticks
>>     its nose in explicitly to manipulate the roles, allowing both ends
>>     to be active.
>>
>>     In the current case, ICE and possible TURN result in getting the
>>     media path established without those games. So maybe there is less
>>     motivation for an intermediary. But still, they still seem to show
>>     up because administrators think they need them. And once there,
>>     couldn't the intermediary still end up making both ends think they
>>     are active?
>>
>> Well, it could but then they wouldn't be able to negotiate DTLS.
>>
>
> Couldn't it negotiation independently on each side - becoming a true MITM.
>
> (I'm not advocating this as a good thing. But if it is possible, there
> will be someone who wants to do it, and somebody willing to sell them stuff
> to do it.)
>

Sure, but then you would need to also intermediate the SCTP.

I'm not following what you see as the problem here.

-Ekr