Re: [rtcweb] Requiring ICE for RTC calls

[Roman Shpount <[e-mail]>]

I would reluctantly have to agree that we should by default require ICE,
since this is the only way to work around the security problems associated
with SIP. I am not sure SRTP has to be required but if ICE is required, SRTP
is an easy requirement to satisfy (if you are putting a media proxy or an
SBC upgrade for one feature, you might as well place it for two). I still
think there should be a way to disable requiring ICE and SRTP through a
local policy, but I am not sure this should be a requirement. I guess what I
am saying that requiring ICE and SRTP should be a SHOULD and not a MUST.
_____________
Roman Shpount


On Tue, Sep 27, 2011 at 4:27 PM, Iñaki Baz Castillo <[e-mail]> wrote:

> 2011/9/27 Olle E. Johansson <[e-mail]>:
> > Sometimes we need to move forward. After many years of insecure calls
> having
> > issues with traversing NATs everywhere, I think enough is enough and it's
> > time to provide a better solution.
>
> I also agree. The IETF has produced lot of security specifications for
> SIP but vendors have implemented nothing (or just a few of them).
>
> SIP is mostly deployed in islands, and each island defines its own
> security constrains (usually no security at all as the island itself
> is a secure wallen garden). Rtcweb is like a new island (a very big
> island), and it will also become the island with major number of
> malicious users and site providers. So let's add all the security
> constrains we can in order to make it secure.
>
> Legacy SIP vendors/providers/manufactures should react if they want to
> offer services on top of rtcweb.
>
> --
> Iñaki Baz Castillo
> <[e-mail]>
>