Re: [rtcweb] Security Architecture: SDES support is a MUST

On 07/20/2012 08:16 AM, Fabio Pietrosanti (naif) wrote:
> On 7/19/12 10:40 PM, Bernard Aboba wrote:
>> Self-signed certificates are only appropriate for a subset of scenarios.  Do
>> we expect IdP to be widely deployed in high security scenarios for
>> government, financial or medical applications?  I do not.
>>    
>> Do we expect a call center to utilize IdP with a self-signed certificate?
>> More likely is that they will utilize a certificate chaining to a trust
>> anchor.
> Until WebRTC does not employ an end-to-end authentication mechanism
> (like ZRTP's SAS applied to DTLS-SRTP), WebRTC is not going to provide
> end-to-end security.
>
> It's not a matter of considering just the encryption, but considering
> the "trust model" .
>
> Current security definition of WebRTC does not support end-to-end security.
The current security definition of WebRTC (with DTLS) provides fingerprints.
If the application is able to verify those fingerprints, security is end 
to end; if it isn't - it isn't.

One specification does not solve all problems.
>
> Fabio
>
> p.s. we have wrote tons of thread about it in past months explaining why
> and how
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb