[rtcweb] Fwd: I-D Action: draft-johnston-rtcweb-zrtp-00.txt

All,

Here's a new I-D on how ZRTP, implemented in JavaScript and run over the
data channel, can be used to provide MitM protection for WebRTC media
sessions keyed with DTLS-SRTP, without relying on any third party service
or PKI. There is an IPR disclosure submitted as well which will show up as
soon as it has been processed - it is of the usual "free if you're not
suing us" variety.

Comments most welcome.

- Alan -

---------- Forwarded message ----------
From: <internet-drafts@ietf.org>
Date: Thu, Aug 22, 2013 at 8:16 PM
Subject: I-D Action: draft-johnston-rtcweb-zrtp-00.txt
To: i-d-announce@ietf.org

A New Internet-Draft is available from the on-line Internet-Drafts
directories.

        Title           : Using ZRTP to Secure WebRTC
        Author(s)       : Alan Johnston
                          Phil Zimmermann
                          Jon Callas
                          Travis Cross
                          John Yoakum
        Filename        : draft-johnston-rtcweb-zrtp-00.txt
        Pages           : 10
        Date            : 2013-08-22

Abstract:
   WebRTC, Web Real-Time Communications, is a set of protocols and APIs
   used to enable web developers to add real-time communications into
   their web pages and applications with a few lines of JavaScript.
   WebRTC media flows are encrypted and authenticated by SRTP, the
   Secure Real-time Transport Protocol while the key agreement is
   provided by DTLS-SRTP, Datagram Transport Layer Security for Secure
   Real-time Transport Protocol.  However, without some third party
   identity service or certificate authority, WebRTC media flows have no
   protection against a man-in-the-middle (MitM) attack.  ZRTP, Media
   Path Key Agreement for Unicast Secure RTP, RFC 6189, does provide
   protection against MitM attackers using key continuity augmented with
   a Short Authentication String (SAS).  This specification describes
   how ZRTP can be used over the WebRTC data channel to provide MitM
   protection for WebRTC media flows keyed using DTLS-SRTP.  This
   provides users protection against MitM attackers without requiring
   browsers to support ZRTP or users to download a plugin or extension
   to implement ZRTP.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-johnston-rtcweb-zrtp

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-johnston-rtcweb-zrtp-00

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
I-D-Announce mailing list
I-D-Announce@ietf.org
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt