[rtcweb] SRTP - mandatory to implement vs mandatory to use (Re: Let's define the purpose of WebRTC)

[Harald Alvestrand <[e-mail]>]

On 11/06/2011 10:16 AM, José Luis Millán wrote:
> draft-ietf-rtcweb-overview-02 downgraded the SRTP concerns from
> mandatory-to-use to mandatory-to-implement. So if it does not
> downgrade anymore, a WebRTC implementation (game app, greeting cards
> website..) will have to implement SRTP.
>
> IMHO, if a web service doesn't want to take, or cannot take, the hit
> for SRTP, WebRTC is not the appropriate solution for such a service.
>
Forking this thread, since it's actually about a line in the documents....

in draft-ietf-rtcweb-overview-02, I changed this section:

5.  Data framing and securing

    SRTP [RFC3550] is used for transport of all real-time media.

    The detailed considerations for usage of functions from RTP and SRTP,
    as well as for non-media real-time data, are given in <WORKING GROUP
    DRAFT "MEDIA TRANSPORTS">.

into this section:

5.  Data framing and securing

    The format for media transport is RTP [RFC3550].  Implementation of
    SRTP [RFC3711] is required for all implementations.

    The detailed considerations for usage of functions from RTP and SRTP
    are given in [I-D.ietf-rtcweb-rtp-usage].  Key negotiation for SRTP
    is described in <MISSING>.  Transfer of data that is not in RTP
    format is described in <MISSING>.

At the moment, draft-ietf-rtcweb-rtp-usage does not contain any 
requirement on SRTP usage (the security section says "A mandatory to 
implement media security solution will be required to be picked", which 
I think is a bit weak), and the discussion at the time did not seem to 
indicate consensus that SRTP must be used always, so I decided to 
document what we seemed to have consensus on - that SRTP MUST be 
implemented.

If we have consensus to make it stronger again, I'm happy to change it back.

                   Harald