Re: [rtcweb] Resolving RTP/SDES question in Paris

["Hutton, Andrew" <[e-mail]>]

Hi,

Completely agree with Hadriel's statement below.

In addition to wanting to know that you are connected to "www.travel.co" or "www.mybank.co" you as a consumer and the company really want/need the media to be recorded by the companies system for your own protection. This is going to involve some kind of MITM or as we call it in SIPREC a Session Recording Client (SRC) to be able to intercept the media and route it to a Session Recording Server (SRS). 

The agent's desktop device could act as the SRC but more likely it will be some kind of B2BUA that does this.  

In these scenario's you as a consumer using this service really want the media to be secure at least as far as reaching the bank but after that like any existing web based system you have to trust the bank with your data this is no different whether that data is speech or text that you entered on a web page.

The recording system should be able to work with DTLS-SRTP but it will most likely act as a MITM so will change the DTLS fingerprint. I don't see that as a problem.

Regards
Andy



> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On
> Behalf Of Hadriel Kaplan
> Sent: 20 March 2012 03:21
> To: Ravindran, Parthasarathi
> Cc: [e-mail]
> Subject: Re: [rtcweb] Resolving RTP/SDES question in Paris
> 
> 
> And, it should be noted, they *want* it that way.  They don't generally
> want you to know which agent picked up the call, or that the call got
> transferred from an IVR to a specific agent, or got put in a queue with
> elevator-music announcement server, or any of that.  You "called"
> Travel Co., and they answered.  What goes on behind that SBC is
> equivalent to the back-end database stuff that goes on between the web
> server and back-end systems, while all you see is the web-server your
> browser happens to be connected to.
> 
> The "identity" you'll get is www.travel.co, which you already had when
> your browser did HTTPS cert verification of their web-server.  HTTPS
> became the key-exchange transport for the SRTP key.  Since they already
> proved they own the cert for www.travel.co, having them claim to be
> www.travel.co shouldn't require yet more verification.
> 
> -hadriel
> 
> 
> On Mar 19, 2012, at 9:15 PM, Ravindran, Parthasarathi wrote:
> 
> > Jim,
> >
> > As a customer, you won't really know whether the identity (DTLS-SRTP)
> of call center/travel site is agent or SBC. SBC can perform MITM attack
> easily as extending SDES-SRTP to DTLS-SRTP for call center site is
> feasible.
> >
> > Thanks
> > Partha
> 
> _______________________________________________
> rtcweb mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rtcweb