IETF Logo Mail Archive

Re: [rtcweb] SRTP not mandatory-to-use

Ted Hardie <ted.ietf@gmail.com> Thu, 05 January 2012 01:23 UTC

Return-Path: <ted.ietf@gmail.com>
X-Original-To: rtcweb@ietfa.amsl.com
Delivered-To: rtcweb@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF2A211E80B9 for <rtcweb@ietfa.amsl.com>; Wed, 4 Jan 2012 17:23:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.197
X-Spam-Level:
X-Spam-Status: No, score=-3.197 tagged_above=-999 required=5 tests=[AWL=0.402, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0fuYXz0KoXmy for <rtcweb@ietfa.amsl.com>; Wed, 4 Jan 2012 17:23:05 -0800 (PST)
Received: from mail-qw0-f51.google.com (mail-qw0-f51.google.com [209.85.216.51]) by ietfa.amsl.com (Postfix) with ESMTP id EA52711E8079 for <rtcweb@ietf.org>; Wed, 4 Jan 2012 17:23:04 -0800 (PST)
Received: by qadz3 with SMTP id z3so45138qad.10 for <rtcweb@ietf.org>; Wed, 04 Jan 2012 17:23:04 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=chh482h9k5708KLXxVOYi3TAiqxirli4WgqhpbWxDek=; b=xXOJLrH3IKltfIZZQx448Ksif8Bb+tMgIz5M1dMePd2du304ZayErdtGcnZSFAoHUh hI584tNsql/IwHtZOidvKFKJdmZVqTdg9kYXV8RXIDQkSnSzZ+ZuQWSb7TVoBlFYfYOg aI7pTmhxItBa/BSf/RhrSvMs9aDSOiSZMnzWk=
MIME-Version: 1.0
Received: by 10.224.100.129 with SMTP id y1mr327294qan.28.1325726584502; Wed, 04 Jan 2012 17:23:04 -0800 (PST)
Received: by 10.229.88.75 with HTTP; Wed, 4 Jan 2012 17:23:04 -0800 (PST)
In-Reply-To: <CAD5OKxuH4v2Cs4Wx2SermhqX0SdH_rXUYgMms1UV3xo1_EsN-Q@mail.gmail.com>
References: <CAErhfrwu322=HTS0JZhum9EGfb73KmYS6CU_KMESyzEWhtvg2w@mail.gmail.com> <CABcZeBOeg-O+6===5tk0haxC8nLxUQyEUFRES2FAoFEf00fKng@mail.gmail.com> <CAErhfrxTKdo7Z+61x5ZcDt5ZM7C7ob5LNxMzwng_kk3Uqrp2_Q@mail.gmail.com> <4F01A790.4060704@alvestrand.no> <4F02A061.60905@jesup.org> <E44893DD4E290745BB608EB23FDDB762141EF8@008-AM1MPN1-042.mgdnok.nokia.com> <4F035DD5.3050305@jesup.org> <CAOJ7v-1dziaA_ePCuMxjn6uhBgOH=ZVybUmLBwQi5qiuyOzDMA@mail.gmail.com> <BLU152-W469B2EB104C104547FC42393960@phx.gbl> <CAD5OKxuE0VhSsjKggj1mLOseLeDXarujvAG44yHkuZttagJggw@mail.gmail.com> <CAKhHsXHnT2p7yncha5-BQ=-Lzk3-N+tuijM-UqwfP1mPUi173A@mail.gmail.com> <CAD5OKxuH4v2Cs4Wx2SermhqX0SdH_rXUYgMms1UV3xo1_EsN-Q@mail.gmail.com>
Date: Wed, 04 Jan 2012 17:23:04 -0800
Message-ID: <CA+9kkMCXACEo0QOLR-pw0AHuRJzKuKEiL7E5Oh8va9wWuFmbow@mail.gmail.com>
From: Ted Hardie <ted.ietf@gmail.com>
To: Roman Shpount <roman@telurix.com>
Content-Type: text/plain; charset="ISO-8859-1"
Cc: rtcweb@ietf.org
Subject: Re: [rtcweb] SRTP not mandatory-to-use
X-BeenThere: rtcweb@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <rtcweb.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/rtcweb>
List-Post: <mailto:rtcweb@ietf.org>
List-Help: <mailto:rtcweb-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 05 Jan 2012 01:23:06 -0000

On Wed, Jan 4, 2012 at 3:23 PM, Roman Shpount <roman@telurix.com> wrote:
>>
> If create connection API request does not specifically allow RTP connection,
> it should not be negotiated. The only possible bid down attack would be due
> to replacement of JavaScript (or some other cross site scripting issue). In
> this case security would already be compromised. So, what exact problem are
> we solving here by removing allow RTP option from the API?
>

I think the bid-down attack being discussed is one in which the user
prefers SRTP but accepts RTP; in those cases an attacker can remove
SRTP from the set offered of offered choices and force an insecure
communication to occur by having the answerer appear to prefer to RTP
(when, in fact, they saw only an RTP choice in the offer).  At least
as far as I can see, this attack is unrelated to the replacement of
the Javascript application.

regards,

Ted
>

v2.23.0 | Report a Bug | By Email