Re: [rtcweb] SRTP not mandatory-to-use

[Bernard Aboba <[e-mail]>]

> If you mandate SRTP (and use DTLS-SRTP), then the application and the
> website never have access to the keys, and you have end-to-end security
> (modulo gateways).  

[BA] That depends very much on the exact design of the system.  Within
RTCWEB the term "DTLS/SRTP" is potentially describing a system
different from the framework used in SIP, if signaling is done out of band (e.g.
we're not assuming that RFC 4474 is being implemented). 

If signalling is out of scope (e.g. SIP is handled in Javascript), then one cannot make 
the same claims about overall system security as one could with a SIP implementation. 
The same thing is true with respect to ICE, by the way -- once you remove signalling
from the scope, the security properties change (e.g. the browser doesn't get to examine
the SDP offer/answer exchange if signaling is done out-of-band).  

> If you combine that with the identity mechanisms
> from ekr's draft/presentation at Taipei, and you have verified, no MITM,
> end-to-end encryption.  

[BA] I would characterize the current draft as lacking in details, frankly.   Do we 
really think that this will be implemented in version 1.0?  If not, then what keying
mechanism do we use along with the "mandatory to use SRTP"?   From my
perspective, making SRTP "mandatory to use" is not very helpful unless we
are clear about how the keying is done.  We don't need to repeat the IPsec/IPv6
experience.