Re: [rtcweb] SRTP not mandatory-to-use

On Tue, Jan 3, 2012 at 3:08 PM, Bernard Aboba <bernard_aboba@hotmail.com> wrote:
> Justin Uberti said:
>

> Requiring SRTP in all circumstances (e.g. offering RTP/SAVP(F) and not
> falling back or allowing negotiation of RTP/AVP(F)) would not preclude
> gateways from translating to RTP/AVP(F), without user knowledge.
>
> This would result in an illusion of security, compared with an actual
> negotiation which would apprise the user as to whether security is actually
> in place.
>
I'm a little lost.  In a gateway implemented in a back-to-back user
agent, won't you end up with the same
illusion?

The case I think you're talking about is this:

UA--1<-Connection1->B2BUA/Gateway<-Connection-2->UA-2

Do you expect that the gateway would be refuse to use SRTP on one side
if it intended not to use it on the other?  That seems pretty unlikely
to me personally, especially in cases where the gateway is to the PSTN
or a standard SIP system.  Or do you expect that the negotiation would
be extended so that the gateway somehow indicates that it will not
SRTP on side two to side one?

If the requirement is SRTP always for WEBRTC, then a b2bUA would have
to run SRTP on boths ides if both UA-1 and UA-2 were WEBRTC
applications, but that seems to be what we want.

What am I missing?

Ted

>
>
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb
>