Re: [rtcweb] state of libsrtp maintenance? (Re: SRTP not mandatory-to-use)

[Randell Jesup <[e-mail]>]

On 1/12/2012 11:18 AM, Roman Shpount wrote:
>
> On Thu, Jan 12, 2012 at 9:37 AM, Eric Rescorla <[e-mail]
> <mailto:[e-mail]>> wrote:
>
>     DTLS-SRTP was specifically designed so that one could put together a
>     DTLS
>     stack and an SRTP stack with minimal modifications to both (and no
>     necessary
>     modifications to the SRTP stack). In the case of OpenSSL and
>     libsrtp, you
>     do the OpenSSL handshake, then use a new interface to export the keys
>     which you then push onto libsrtp using existing interfaces.
>
> My point is if you use OpenSSL crypto functions you can replace libsrtp
> with a few hundred lines of code. It is almost easier then integrating
> with libsrtp (and introduce another instance of unoptimized encryption
> and check sum functions).

I'm not tied to libsrtp - though I have commit privileges for it, and 
made a bunch of improvements and fixes to it back in the 2004-2005 
timeframe (SRTCP was broken, remove dependence on long long, etc), since 
which point (around 2006) it's been very stable outside of a very 
occasional patch.

Last set of changes generally seem to be around a year and half ago by 
Jonathan Lennox. (A few minor C99 changes this fall).

It does the job.  Perhaps you can replace it with a few hundred lines of 
OpenSSL code; I have to say I'd be surprised.  But srtp.c is ~2000 
lines; I can believe OpenSSL would replace most of the crypto files; 
you'd still need much of the logic in srtp.c and perhaps the replay code.

And realize we're not specifying libsrtp, just SRTP - so your comment 
that libsrtp can be replaced with OpenSSL plus some code is simply more 
indication that SRTP implementations are not a blocker.


-- 
Randell Jesup
[e-mail]