[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [AVT] Fwd: [Tsvwg] Looking for feedback on DTLS

Mark Baugher <mbaugher at cisco.com> wrote:

> Hi Mats
>     Your point is well taken about decoupling SRTP from key
>     management, which varies from pairwise key management using (say)
>     IKE or MIKEY to broadcast key management using subset difference.
>     I don't think DTLS has much relevance to AVT protocols and am
>     copying the authors and security ADs to check my reasoning.
>     SSL/TLS has been successfully deployed for a class of
>     client/server applications.  That is outstanding.  It has some
>     vulnerabilities, however, that have been exploited by phishing
>     attacks, which is bad. 

Phishing is a social attack, not an attack on anything specific
to SSL. It would work just as well against, say, HTTP over IPsec.


>     But regardless of the pros and cons of
>     SSL/TLS vs. IPsec, RTP has many peer-to-peer applications.  I
>     think that IPsec and/or SRTP can adequately protect almost any
>     real-time RTP session between peers or between clients and server.
>     I can't think of anything DTLS will do for AVT protocols beyond
>     adding an unneeded alternative - and the accompanying confusion -
>     to the mix.
>
>    http://www.ietf.org/internet-drafts/draft-rescorla-dtls-01.txt
>    should probably specifically state that it is not appropriate for
>    the RTP family of protocols.

I don't understand the argument here. Unless there's some technical
reason why DTLS won't work for these applications, I don't understand
why the existence of alternative mechnisms requires a statement
that DTLS is inappropriate...

-Ekr


_______________________________________________
Audio/Video Transport Working Group
avt at ietf.org
https://www1.ietf.org/mailman/listinfo/avt