Re: [rtcweb] Require/Suggest AEAD GCM for SRTP

[Harald Alvestrand <[e-mail]>]

Once cluster 238 is published, I'm in favor of looking at the
mandatory-to-implement ciphersuites in RTCWEB and consider updating
them. It's been a few years since we went through that exercise.

I am not in favor of proposing changes to the current documents.

Den 10.07.2019 20:06, skrev Sean DuBois:
> Hello,
> I am Sean DuBois, I work on Pion [0] a 100% Go implementation of
> WebRTC. I have a user that is trying to do a large deployment, and
> performance is very important to them. They see a 10x performance
> improvement when using AEAD GCM for SRTP (thanks to HW acceleration)
> and is the most obvious improvement we can make.
> 
> Having this would be a pretty fantastic improvement for very little
> work. Especially for weak devices/scaling servers, AES-NI is a huge
> deal. Also great for security, avoids possible timing attacks from
> software implementation and just less for developers can mess up when
> implementing SRTP themselves!
> 
> This also should be pretty painless change.
> * FireFox already supports it
> * Chromium is just behind a flag [1]
> * Most other implementations also use libsrtp (where it is already available)
> * Adding more protection profiles will have zero impact if they aren't
> supported.
> 
> ----
> I have never been involved with the IETF before, but this seems the
> best way to push implementations to support it.
> 
> [0] https://github.com/pion/webrtc
> [0] https://bugs.chromium.org/p/chromium/issues/detail?id=713701#c20
> 
> _______________________________________________
> rtcweb mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/rtcweb
>