Re: [rtcweb] WebRTC-SIP interop: and why SDES-SRTP is a need

[Iñaki Baz Castillo <[e-mail]>]

2012/4/3 Iñaki Baz Castillo <[e-mail]>:
> Hi all,
>
> I've made two "pictures" showing WebRTC and SIP interop for two cases:
>
> 1) SDES-SRTP is allowed in WebRTC:
>      http://public.aliax.net/WebRTC/WebRTC_SIP_Interop_SDES-SRTP.png
>
> 2) Just DTLS-ETK-SRTP is allowed in WebRTC [*]
>      http://public.aliax.net/WebRTC/WebRTC_SIP_Interop_DTLS-EKT-SRTP.png
>
> [*] slides 30-35 in
> http://tools.ietf.org/agenda/83/slides/slides-83-rtcweb-3.pdf
>
>
> For those claiming to mandate *just* DTLS-EKT-SRTP in WebRTC, please
> see the *cost* of such a decision, and also:
>
> - Thanks for requiring a super Signaling+Media B2BUA/SBC in WebRTC/SIP
> interop scenarios. Some vendors will be very happy and will become
> very rich. Such a super device (also a DTLS to SDES conversor,
> including DTLS key updates to re-INVITE) will be "a bit"... expensive.
>
> - Thanks for disallowing *pure* SIP protocol usage (and instead
> requiring SIP B2BUAs/SBCs or custom WebRTC signaling to SIP conversion
> gateways). WebRTC is supposed to let the signaling protocol up to the
> application, but pure SIP protocol will not be possible since a SIP
> B2BUA/SBC is required, and those devices always break/limit the SIP
> protocol (*always*).
>
>
> So IMHO, option 2 ("just DTLS-EKT-SRTP is allowed in WebRTC") is The Barrier.


Hi, nobody cares about the implications of option 2 ???

Do all the people planning to interop with SIP assume that they'll
need the super B2BUA in the second image (without the possibility of
using a pure SIP proxy)?:

  http://public.aliax.net/WebRTC/WebRTC_SIP_Interop_DTLS-EKT-SRTP.png


BTW Fabio has sent two magistral mails explaining why DTLS is not the
panacea and why SDES can be good enough to satisfy the same level of
security than DTLS. No comments?


Regards.


-- 
Iñaki Baz Castillo
<[e-mail]>