Re: [AVT] SRTP store-and-forward

[Rolf Blom <rolf.j.blom at ericsson.com>]

Hi Eric,

My experience is that secure email becomes of more and more interest for enterprises and government authorities. Such organizations already now invest in the needed infrastructure to enable handling of user certificates and other types of user credentials for secure access and communication. I also expect that in the future, secure email will be used more and more by the general public for privacy reasons. Look e.g. at the success for PGP.

/Rolf



Eric Rescorla wrote:

When you refer to MIKEY-RSA having some mechanism to acquire such
information (shared key / certificate) I believe you refer to
MIKEY-RSA-R. In MIKEY-RSA-R the initiator attaches his certificate in
the first message and the responder uses it to return the key to be
used. This works well when there is an on-line connection between the
two but  wouldn't work for SRTP  Store-and-Forward applications. Here
we must rely on either predistributed keys or certificates or that keys
or certificates can be acquired from an online third party. As I said
before this situation is exactly as for secure email. And secure email
is used!
    

I would say extraordinarily rarely. Indeed, this is precisely one
of the challenges that led to RTPSEC.

-Ekr


  

-- 
Rolf Blom, Ph.D. Expert, Mobile Communications Security, Ericsson Research
Postal address: Ericsson AB, SE-164 80 STOCKHOLM, Sweden
Tel: +46 10 713 17 07,  GSM: +46 70 757 2092,  Fax: +46 8 757 01 35


This communication is confidential and intended solely for the
addressee(s). Any unauthorized review, use, disclosure or distribution
is prohibited. If you believe this message has been sent to you 
in error, please notify the sender by replying to this transmission 
and delete the message without disclosing it. Thank you.

E-mail including attachments is susceptible to datacorruption, 
interruption, unauthorized amendment, tampering and viruses, and 
we only send and receive e-mails on the basis that we are not 
liable for any such corruption, interception, amendment, tampering
or viruses or any consequences thereof.