Re: [rtcweb] Support of SDES in WebRTC

Hi Fabio,

My assumption has always been the following:

- DTLS-SRTP is the default
- DTLS-SRTP + identity can be turned on via the JavaScript API if the webapp wishes to do so
- SDES can be turned on by a manipulated SDP offer/answer provided the entire webapp was retrieved over HTTPS

BTW I'm also in favor of _only_ allowing the SRTP NULL encryption algorithm in browser debug/developer mode.

Regards,

Oscar Ohlsson

> -----Original Message-----
> From: rtcweb-bounces@ietf.org 
> [mailto:rtcweb-bounces@ietf.org] On Behalf Of Fabio Pietrosanti (naif)
> Sent: Thursday, March 29, 2012 10:54 AM
> To: <rtcweb@ietf.org>
> Subject: [rtcweb] Support of SDES in WebRTC
> 
> On the topic of SDES vs DTLS-SRTP a very nice analysis has 
> been done on:
> http://www.potaroo.net/ietf/idref/draft-ohlsson-rtcweb-sdes-support/
> 
> Considering how vague are the security implementation 
> consideration of DTLS-SRTP and how widely diffused in 
> SDES-SRTP, i'm wondering whenever we should not mandate the 
> use of SDES-SRTP.
> 
> That way we would be able to see:
> 
> - All implementation will start with SDES (simpler and quicker)
> - For who want enhanced security, greater implementation and 
> interoperability complexity, implement also DTLS-SRTP
> 
> But for the industry a full cycle of:
> - Implementation
> - Stabilization
> - Interoperability
> 
> for DTLS-SRTP (that nobody use) may require from 2 up to 4-5 
> years of time.
> 
> If we goes for SDES-SRTP by default, as early choice, probably within
> 1-2 years at maximum we can expect the overall technological 
> ecosystem to be stable and interoperable.
> 
> Because it will be built on top of existing stable framework.
> 
> We may save dozens millions of USD of investments costs for 
> the industry and gain some hundreds millions of users year in 
> advance, just because we would save several years of time.
> 
> I think that those consideration are valuable enough to 
> strongly consider arguments in making SDES-SRTP a preferred, 
> mandatory implementation for WebRTC.
> 
> --
> Fabio Pietrosanti
> Founder, CTO
> 
> Tel: +39 02 85961748 (direct)
> Mobile: +39 340 1801049
> E-mail: fabio.pietrosanti@privatewave.com
> Skype: fpietrosanti
> Linkedin: http://linkedin.com/in/secret
> 
> PrivateWave Italia S.p.A.
> Via Gaetano Giardino 1 - 20123 Milano - Italy 
> www.privatewave.com _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb
> 