Subject: [rtcweb] On DTLS-SRTP trust model (and consideration for SDES-SRTP)

From: "Fabio Pietrosanti (naif)" <[email-masked]>
Date: Tue, 03 Apr 2012 20:00:33 +0200

>From trust model SDES-SRTP it's very similar with DTLS-SRTP with the
regards to the need to trust third party with no real end-to-end
authentication/encryption support.

Let me explain this assumption:

- DTLS-SRTP key exchange without fingerprint/identity verification mean
"false sense of security" = no security

- DTLS-SRTP to verify fingerprint require identity services
- Identity services rely on trusted third parties
- Trusted third party identity services rely on TLS (https)

So basically in any case the 'root of trust' is based on TLS.

>From http://www.ietf.org/id/draft-ietf-rtcweb-security-arch-01.txt :

4.1.  Initial Signaling
[...]

   Based purely on the interface provided
   by the signaling server, they know that the signaling server claims
   that the call is from Alice to Bob.

4.3.  DTLS Handshake
[...]

   If Alice and Bob authenticated via their IdPs,
   then they also know that the signaling service is not attacking them.
   Even if they do not use an IdP, as long as they have minimal trust in
   the signaling service not to perform a man-in-the-middle attack, they
   know that their communications are secure against the signaling
   service as well.

5.1.  Origin and Web Security Issues

   The basic unit of permissions for RTCWEB is the origin [RFC6454].
   Because the security of the origin depends on being able to
   authenticate content from that origin, the origin can only be
   securely established if data is transferred over HTTPS [RFC2818].

So, while i totally agree to get DTLS-SRTP into the standard but please
don't consider it the "panacea" as it's trust model, for how it's proposed:
- DTLS-SRTP work securely when relying on trusted third party for idP
- DTLS-SRTP work securely when you trust the signaling services
- DTLS-SRTP work securely only when you trust third party that are trued
via other TLS/CA based trust chain:
  - signaling service (web server)
  - identity provider

So to have a "secure DTLS-SRTP" infrastructure that guarantee end-to-end
encryption the user is not independent (like for ZRTP SAS that the
authors of rtcweb-security-arch doesn't consider a valuable point) but
must rely on at least 2 separate third party services that rely on TLS
trust model.

With SDES-SRTP you get "less security" than what DTLS-SRTP can provide
but with an "order of magnitude" of simplicity because:
- SDES-SRTP work securely when relying on a single party for TLS

So again summarizing:

- DTLS-SRTP "can" provide end-to-end crypto...
...ONLY IF the user trust 2 services that rely on TLS
 (the user trust at least 2 different services, signaling + idP)

- SDES-SRTP "can" provide end-to-site crypto...
..ONLY IF the user trust 1 single service with TLS

That's my point in arguing that SDES-SRTP MUST be implemented for it's
strongest simplicity in implementation and in providing end-to-site
encryption without all the high complexity DTLS-SRTP.

But always consider that DTLS-SRTP, in order to be secure, still require
the user to trust some third party and it's not able to independently
verify the trust-condition of the other user.

It's a matter of considering which trust scenario you want to protect
about.

DTLS-SRTP represent the "elephant in a room" concept, where a *huge
level of complexity* is under the hood to be able to provide even a
basic security level (even end-to-site encryption), and the end-user
doesn't have a real way to understand "which security level" he is.

At least with SDES-SRTP the user know that there is less, but simpler to
be guaranteed, specific end-to-site security model (i connect to gmail,
i trust gmail snooping my email).

Please consider that as the stratification of complexity for DTLS-SRTP
will probably result in practical less-reduced-security.

IMHO any technology must provide protection against a specific risk
model, here in this WG we are saying that DTLS-SRTP is the panacea for
all the risk-model.

That's unfortunately not true.

There is "the right technology" to face "the right risk context" and
when you try to make the use of a "specific technology" to satisfy all
the risk context, the results are not always very good, due to the
complexity of different factors to be considered.

If we think that just providing something that can deliver "unsecure
end-to-end encryption" by providing a "false sense of security" is a
good things, let's goes on.

But imho every technology must be specifically adapted to a specific
risk scenario.

If we want to really consider DTLS-SRTP's end-to-end encryption, the
fingerprint checking must be completely in the hand of the user, with
ZRTP's like SAS checking and not rely on third party services for trust.

Fabio