Re: [rtcweb] SRTP not mandatory-to-use

[Randell Jesup <[e-mail]>]

On 1/11/2012 4:41 PM, Eric Rescorla wrote:
> On Wed, Jan 11, 2012 at 1:20 PM, Randell Jesup<[e-mail]>  wrote:
>> I'd like to explore the possibility of making sure there's a workable
>> DTLS-SRTP implementation openly available, and locking WebRTC down to that
>> only.
>>
>> I should note that while libsrtp 1.4.2 (last official release) doesn't have
>> DTLS-SRTP support, there are DTLS-SRTP support functions and test code in
>> the project's CVS since ~2006, and resiprocate/recon supports DTLS-SRTP via
>> a modified OpenSSL.  So, I'm not sure the barrier is huge given DTLS support
>> already.
>
> The situation is actually rather better than this:
>
> 1. OpenSSL 1.0.1 (currently in beta) has all the TLS-side support needed for
>      DTLS-SRTP.
> 2. The new entry points in libsrtp, while helpful are just helper
>      functions. If you're willing to embed a bit of knowledge about key
> construction
>      into the application, you should be able to use libsrtp 1.4.2.
> (though I suspect
>      you actually don't want to. libjingle, for instance, recommends use of the
>      libsrtp CVS version).
> 3. As you say, resip and recon have support for DTLS-SRTP, though you
> likely won't
>      need it for WebRTC anyway, since that support is largely SIP-specific.
>
> So in terms of having a working implementation, the issue is primarily
> integration into your WebRTC stack

Great, all this sounds good.

> FWIW, my take on the broader question is that the key issue is how we wish
> to interop with legacy SIP/PSTN-type stuff. If we want it to be possible to
> interop without media gatewaying, then the large amount of non-SRTP gear
> means that as a practical matter one must support RTP. SDES is almost
> an afterthought in this scenario, in that it would allow you to interop with
> SRTP with some unknown but probably relatively small fraction of the
> installed base.
>
> If you don't care about interop without media gatewaying, then there is no
> reason to do anything other than SRTP and I would argue no need to do
> anything other than DTLS, because there's no backward-compatibility
> issue.

I agree, and since I believe the answer is "no interop without a media 
gateway" (I've tried to figure a safe way, no luck unless you relax the 
requirements for consent and the like), then I come down on 
SRTP-mandatory, DTLS-SRTP strongly preferred to be mandatory unless 
there's an implementation roadblock.


-- 
Randell Jesup
[e-mail]