Re: [rtcweb] Let's define the purpose of WebRTC

["Muthu Arul Mozhi Perumal (mperumal)" <[e-mail]>]

|"1) Security could be in the lower layer itself 
|(IPsec, VPN, private MPLS cloud). For Enterprise-only-
|WebRTC application (no federation & no interop), 
|there is no need of security for specific application
|like WebRTC as it is ensured in the infrastructure.

One of the primary deployments for SRTP I've come across is actually
within the enterprise -- financial institutions and defense
establishments concerned about eavesdropping within their organization.
The fact that the WAN connection is secured using IPSec VPN or a private
leased line isn't good enough for such deployments.

Muthu

|-----Original Message-----
|From: [e-mail] [mailto:[e-mail]] On
Behalf Of Ravindran Parthasarathi
|Sent: Wednesday, November 09, 2011 8:28 AM
|To: Cullen Jennings (fluffy); Olle E. Johansson
|Cc: <[e-mail]>
|Subject: Re: [rtcweb] Let's define the purpose of WebRTC
|
|Cullen,
|
|As I mentioned in
http://www.ietf.org/mail-archive/web/rtcweb/current/msg02674.html, below
comment #2
|is not valid in IETF.
|
|But I'm interested in your opinion as Enterprise UC expert on my 1st
comment:
|
|"1) Security could be in the lower layer itself (IPsec, VPN, private
MPLS cloud). For Enterprise-only-
|WebRTC application (no federation & no interop), there is no need of
security for specific application
|like WebRTC as it is ensured in the infrastructure. WebRTC security
will be duplicated for these
|infrastructure and may lead to double encryption unnecessarily."
|
|Thanks
|Partha
|
|>-----Original Message-----
|>From: Cullen Jennings [mailto:[e-mail]]
|>Sent: Tuesday, November 08, 2011 9:29 PM
|>To: Olle E. Johansson
|>Cc: Ravindran Parthasarathi; <[e-mail]>
|>Subject: Re: [rtcweb] Let's define the purpose of WebRTC
|>
|>
|>On Nov 8, 2011, at 7:58 AM, Olle E. Johansson wrote:
|>
|>>>
|>>> 2) Being in India, I'm interested in avoiding Government
restriction
|>on WebRTC proposal (Thanks to Tim for pointing this). I may not
surprise
|>to see that WebRTC mechanism is banned in India because intelligent
|>agency struggles to break the key in each terrorist WebRTC site.
|>(http://www.pcworld.com/businesscenter/article/235639/india_wants_to_i
nt
|>ercept_skype_google_communications.html)
|>> That is an interesting objection. I don't think SRTP by default is
the
|>problem here. In the case where you need lawful interception in the
|>application,
|>> the server needs to route the calls through an RTCweb b2b media
|>server.
|>
|>I think the situation in India is a taxiation not encryption issue.
|>Partha and I can do VoIP between Canada and India fully encrypted no
|>problem - in fact we have a dial plan set up specifically so I can do
|>that with him. The issue is a taxation issue. If we want to be able to
|>connect that voip server to the PSTN in a way that it becomes what the
|>regulators in India consider a telephone service, then we need
|>permission to effectively be an indian telco. Right now I can make a
|>full SRTP encrypted conversation with between my IP phones and
Partha's
|>but I don't think Partha can use his IP phone to access one the the
PSTN
|>GWs outside India.
|>
|>Anyways, I will remind people of RAVEN http://www.rfc-
|>editor.org/rfc/rfc2804.txt
|>
|
|_______________________________________________
|rtcweb mailing list
|[e-mail]
|https://www.ietf.org/mailman/listinfo/rtcweb