Re: [rtcweb] SBC hardware and SHA1

[Eric Rescorla <[e-mail]>]

On Fri, Sep 30, 2011 at 9:39 AM, Hadriel Kaplan <[e-mail]>wrote:

>
>  On Sep 30, 2011, at 2:36 AM, Olle E. Johansson wrote:
>
>   Hadriel,
>  While on the topic of the hardware, I would like to ask how these systems
> handle DTLS and SRTP.
>
>
>  Assuming you mean terminating the SRTP, I only know of one hardware-based
> SBC that claims support for terminating DTLS-SRTP, but I don't know if it's
> real or slideware.  I know of a couple software-based ones that do. (you can
> probably google it to find out who)
>

I don't know a huge amount about how hardware-based SBCs are constructed,
but it's important
to remember that DTLS-SRTP is DTLS key management but SRTP data transport,
so the naive
way to build the system would be to do the DTLS in software and then push
the keys onto
SRTP, thus using all the normal SRTP packet processing.

Obviously, there will be some performance cost associated with this (as
there is for any
asymmetric key exchange). The typical acceleration strategy for TLS is to
have hardware
acceleration for the asymmetric operations but have the actual TLS stack in
software,
for the obvious reasons of flexibility and upgradeability. Don't know how
much that
helps.

-Ekr



> But in general the most popular support by far is for SDES-based keying.
>  There are a couple of off-the-shelf chip solutions for large-scale SRTP
> that handle it as a bump-in-the wire, but they need to be told the keys per
> stream and don't handle DTLS inline themselves to do so, so naturally SDES
> made it a lot easier to use them.  Having said that, I do believe that more
> SBC vendors in the US market will be supporting DTLS-SRTP in the future
> because the US government has it mandated in some agency or other I've been
> told.  Whether other governments will do the same I don't know. (then again
> the US government mandates a lot that never gets used in practice)
>
>  Also, someone asked on this list if SBC vendors support SRTP to begin
> with.  Almost every SBC vendor I know of does support SRTP (at least with
> SDES keying), but it usually costs more to do so, because it's done in
> dedicated hardware.  So most deployed SBC systems don't do SRTP, because the
> people buying/deploying them have decided they don't need it and don't want
> to pay for it.  It's more popular in specific vertical markets, but overall
> it's definitely a minority today.
>
>  -hadriel
>
>
>
> _______________________________________________
> rtcweb mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rtcweb
>
>