Re: [rtcweb] End-to-end encryption vs end-to-end authentication (DTLS-SRTP / SDES-SRTP)

Iñaki Baz Castillo <ibc@aliax.net> Thu, 05 April 2012 18:45 UTC

MIME-Version: 1.0
In-Reply-To: <CAD5OKxs1nwNgaPOxcjW1=yJS-CMZLWj1rzx8wzmcHzOF6j9Z3Q@mail.gmail.com>
References: <4F7D7103.6040102@infosecurity.ch> <4F7DBEFC.6040302@alcatel-lucent.com> <4F7DD13F.2010006@infosecurity.ch> <CAD5OKxv_e9Ncw7xt3eh9jNM9HWX1snDN1wVynkFT2GPoA+y1_w@mail.gmail.com> <4F7DE01C.4040800@infosecurity.ch> <CAD5OKxtDXX1A1hewxZeFZMcs4f4o6BqCy8UYpi5LMngj2GudfQ@mail.gmail.com> <CALiegf=Bf5Q7ODUZccJiEOn-ibWk7aDx9-MGNmGLCusGGjfvxg@mail.gmail.com> <CAD5OKxs1nwNgaPOxcjW1=yJS-CMZLWj1rzx8wzmcHzOF6j9Z3Q@mail.gmail.com>
From: Iñaki Baz Castillo <ibc@aliax.net>
Date: Thu, 05 Apr 2012 20:44:57 +0200
Message-ID: <CALiegfm8LjgSTLTSxvC31Z_OW33iA1jomYPa0tzrt0WBVQKAog@mail.gmail.com>
To: Roman Shpount <roman@telurix.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Cc: rtcweb@ietf.org
Subject: Re: [rtcweb] End-to-end encryption vs end-to-end authentication (DTLS-SRTP / SDES-SRTP)
Precedence: list

2012/4/5 Roman Shpount <roman@telurix.com>:
> On Thu, Apr 5, 2012 at 2:19 PM, Iñaki Baz Castillo <ibc@aliax.net> wrote:
>>
>> Define such an "alternative communications channel" and explain me how
>> the signaling server cannot alter that channel.
>>
>
> I will send it to you using Frogo, my trusty carrier pidgin ;).
>
> I can read them to you (possible to modify but much harder then simple
> signaling), I can email them to you using some sort of trusted service, or I
> can call you using old fashioned telephone. I remember times when such keys
> were exchanged via fax.

So the success of DTLS (the "security end-to-end panacea") depends on
two users of any web sharing their "keys" via email, phone, or fax...

Did you forget the <sarcasm> tag? XD

-- 
Iñaki Baz Castillo
<ibc@aliax.net>

Re: [rtcweb] End-to-end encryption vs end-to-end … Fabio Pietrosanti (naif)
[rtcweb] End-to-end encryption vs end-to-end auth… Fabio Pietrosanti (naif)
Re: [rtcweb] End-to-end encryption vs end-to-end … Igor Faynberg
Re: [rtcweb] End-to-end encryption vs end-to-end … Roman Shpount
Re: [rtcweb] End-to-end encryption vs end-to-end … Iñaki Baz Castillo
Re: [rtcweb] End-to-end encryption vs end-to-end … Igor Faynberg
Re: [rtcweb] End-to-end encryption vs end-to-end … Fabio Pietrosanti (naif)
Re: [rtcweb] End-to-end encryption vs end-to-end … Roman Shpount
Re: [rtcweb] End-to-end encryption vs end-to-end … Iñaki Baz Castillo
Re: [rtcweb] End-to-end encryption vs end-to-end … Roman Shpount
Re: [rtcweb] End-to-end encryption vs end-to-end … Iñaki Baz Castillo
Re: [rtcweb] End-to-end encryption vs end-to-end … Ravindran, Parthasarathi