Subject: [rtcweb] New security draft

From: Cullen Jennings <[email-masked]>
Date: Wed, 7 Sep 2011 10:41:01 -0600

I see that EKR published an updated security draft at 

http://tools.ietf.org/html/draft-rescorla-rtcweb-security-01

Just wanted to point that out to the list.

Cullen

---

From: Christer Holmberg <[email-masked]>
Date: Thu, 8 Sep 2011 13:57:46 +0200

Hi,

One question regarding section 4.2 (Communications Consent Verification).

When SRTP is used, could the security establishment procedure for SRTP also be used for communications consent verification purpose?

Regards,

Christer

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Cullen Jennings
> Sent: 7. syyskuuta 2011 19:41
> To: [email-masked]
> Subject: [rtcweb] New security draft
> 
> 
> _______________________________________________
> rtcweb mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/rtcweb
>

---

From: Harald Alvestrand <[email-masked]>
Date: Thu, 08 Sep 2011 14:06:22 +0200

> When SRTP is used, could the security establishment procedure for SRTP also be used for communications consent verification purpose?
I don't think so, because if the other party lies about his IP address, 
this does not affect the key negotiation when the key negotiation is 
done out-of-band (with SDES).

If using DTLS-SRTP, the ICE handshake has to complete before the keys 
can be negotiated, so verifying consent to communication comes for free 
with the ICE handshake anyway.