Re: [rtcweb] SRTP not mandatory-to-use

[Roman Shpount <[e-mail]>]

>
>  Justin Uberti said:
>
> "If we make SRTP mandatory to use, people will figure out a way to make
> SRTP work in their scenarios. If we don't, people will continue to use the
> same old objections as to why they can't deploy SRTP.
>
>
>
I thought our goal is to design a web based real time communication network
with the widest possible set of capabilities. I never thought that the goal
of this group is to promote other architectural agendas, even the ones as
such as spreading communications security. Security of communications would
be defined by the application developer. If application developer designs
something that is meant to be insecure (like place all calls through a
middle server that will record everything and publish it on an open web
site), it would be. I do not understand why application developer with
WebRTC should not have an option to communicate without SRTP. Ability for
developer to specify that RTP is allowed for certain connection takes
nothing from security of WebRTC, and makes a lot of issues (such as
interop, getting initial application developed and tested, etc) a lot
simpler.

I do believe that SRTP CPU load argument is nonsense (especially with newer
CPUs where there is hardware AES offload), but I the only argument I heard
so far for mandatory SRTP use was that future WebRTC developers are so
incompetent and ignorant that they will never use SRTP unless we force
them. Make it simple to specify that SRTP is required via an API, make it
default, and developers will use it. As long as WebRTC connection does not
automatically fall back to RTP if SRTP connection is required and cannot be
established, I simply don't see what the problem is.
_____________
Roman Shpount