Re: [rtcweb] state of libsrtp maintenance? (Re: SRTP not mandatory-to-use)

Making libsrtp so it had a compile time flag to use the openssl crypto or select it's own crypto seem like it would be a nice improvement to it but lots of the places folks want to use libsrtp is a DSP of some sort - it cab be a big hassle to try and port all of the crypto from openssl to that type of environment so probably would not want to have it require openssl. 

On Jan 12, 2012, at 2:54 PM, Randell Jesup wrote:

> On 1/12/2012 11:18 AM, Roman Shpount wrote:
>> 
>> On Thu, Jan 12, 2012 at 9:37 AM, Eric Rescorla <ekr@rtfm.com
>> <mailto:ekr@rtfm.com>> wrote:
>> 
>>    DTLS-SRTP was specifically designed so that one could put together a
>>    DTLS
>>    stack and an SRTP stack with minimal modifications to both (and no
>>    necessary
>>    modifications to the SRTP stack). In the case of OpenSSL and
>>    libsrtp, you
>>    do the OpenSSL handshake, then use a new interface to export the keys
>>    which you then push onto libsrtp using existing interfaces.
>> 
>> My point is if you use OpenSSL crypto functions you can replace libsrtp
>> with a few hundred lines of code. It is almost easier then integrating
>> with libsrtp (and introduce another instance of unoptimized encryption
>> and check sum functions).
> 
> I'm not tied to libsrtp - though I have commit privileges for it, and made a bunch of improvements and fixes to it back in the 2004-2005 timeframe (SRTCP was broken, remove dependence on long long, etc), since which point (around 2006) it's been very stable outside of a very occasional patch.
> 
> Last set of changes generally seem to be around a year and half ago by Jonathan Lennox. (A few minor C99 changes this fall).
> 
> It does the job.  Perhaps you can replace it with a few hundred lines of OpenSSL code; I have to say I'd be surprised.  But srtp.c is ~2000 lines; I can believe OpenSSL would replace most of the crypto files; you'd still need much of the logic in srtp.c and perhaps the replay code.
> 
> And realize we're not specifying libsrtp, just SRTP - so your comment that libsrtp can be replaced with OpenSSL plus some code is simply more indication that SRTP implementations are not a blocker.
> 
> 
> -- 
> Randell Jesup
> randell-ietf@jesup.org
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb