Re: [rtcweb] Final plea about SRTP

["Fabio Pietrosanti (naif)" <[e-mail]>]

On 5/4/12 8:21 AM, Magnus Westerlund wrote:
> Hi Roman,
> 
> In my role as a WG chair I have to say that the decision to make SRTP
> mandatory to use for WebRTC had a very strong consensus behind it. Yes,
> there are some few individuals like yourself that are on the rough side
> of this decision.
> 
> My personal opinion is that the discussion so far in this thread has
> raised most of the issues with supporting both. I think the bid-down
> problem is one of the largest for most people. I also see a great
> benefit with always using SRTP, in that we will get rid of RTP profile
> negotiation. There will be no need to support any other RTP profile than
> SAVPF.

So next main points to be defined, as far as i understand, is by
consensus working on key exchange methods that could be more or less:
- Use only DTLS-SRTP (as it is)
- Use only DTLS-SRTP-EKT
- Use DTLS-SRTP + SDES-SRTP

Other than this i would also suggest to suggest discussing about the
"Authentication" of the call, that currently with DTLS-SRTP can be:
- Based on idP (external identity provide)
- Unauthorized

I would also introduce the ability to verify the DTLS-SRTP call directly
and without intermediary (no trusted third party like idP), with methods
such as SAS.

That's the only way to achieve the "end-to-end security" property that
DTLS-SRTP would like to bring in WebRTC standard.

Otherwise DTLS-SRTP will provide "end-to-end encryption with end-to-site
security" but NO end-to-end security.

Fabio