Re: [rtcweb] SRTP not mandatory-to-use

[Eric Rescorla <[e-mail]>]

On Wed, Dec 14, 2011 at 3:18 PM, Xavier Marjou <[e-mail]> wrote:
> Hi,
>
>
> During the last IETF meeting, there seemed to be many people willing to have
> SRTP mandatory-to-use in the browser. However, I would like again to
> underline that in some contexts, it is rather desirable to deactivate, via
> the WebRTC API, the use of SRTP in order not to encrypt/decrypt at multiple
> layers.
>
>
> This may be the case in the following example: a company wants to use WebRTC
> for communications between its co-workers only; the web server and the
> script using WebRTC API are located on the VPN. In such a case, there is no
> need to use SRTP. The VPN already provides encryption when needed. If
> co-workers want to remotely access the VPN, an IPsec tool can already
> provide the encryption. Furthermore, if they want to remotely access the VPN
> via a 3G network, there will be encryption at layer 2 using AKA, then IPsec
> at layer 3, and again at SRTP level if mandatory-to-use.

I don't understand why this makes SRTP undesirable. What scarce
resource are you conserving
here by not using SRTP? As has been noted a number of times, the cost
of the crypto on
the endpoints is generally not significant.

Moreover, it's not obvious that even in this setting SRTP doesn't add security
benefit. Why are you assuming that I want everyone on the same LAN
as me to be able to listen to my calls, even if they are my co-workers?

-Ekr