DTLS-SRTP

All posts tagged DTLS-SRTP

webrtcH4cKS: ~ Does your video call have End-to-End Encryption? Probably not..

Posted by Philipp Hancke on April 1, 2020
Posted in: Standards.
Tagged: , , , .
12 comments

Time for another opinionated post. This time on… end-to-end encryption (e2ee). Zoom apparently claims it supports e2ee while it can not satisfy that promise. Is WebRTC any better?

Zoom does not have End to End Encryption

Let’s get to the bottom of things fast: Boo Zoom!

I reviewed how Zoom’s implements their web client last year.

I’m not really surprised of their general lack of e2ee given that their web client did not provide any encryption on top of TLS or WebRTC’s DataChannel. For reasons we will discuss below, this means they weren’t doing any obvious e2ee there. ...  Continue reading

webrtcH4cKS: ~ WebRTC and Man in the Middle Attacks

Posted by Tsahi Levent-Levi on June 12, 2015
Posted in: Technology.
Tagged: , , , .
7 comments

WebRTC is supposed to be secure. A lot more than previous VoIP standards. It isn’t because it uses any special new mechanism, but rather because it takes it seriously and mandates it for all sessions.

Alan Johnston decided to take WebRTC for a MitM spin – checking how easy is it to devise a man-in-the-middle attack on a naive implementation. This should be a reminder to all of us that while WebRTC may take care of security, we should secure our signaling path and the application as well. ...  Continue reading

webrtcH4cKS: ~ WebRTC MUST implement DTLS-SRTP but… MUST NOT implement SDES?

Posted by Victor Pascual on August 12, 2013
Posted in: Standards.
Tagged: , , , , .
6 comments

As I anticipated in my post on WebRTC standardization, the IETF 87th meeting took place last week in Berlin, Germany. One of the agenda items for WebRTC was whether SDES should be part (and how) of WebRTC.

According to the IETF drafts, any WebRTC compliant implementation must support the RTP/SAVPF profile which builds on top of the Secure RTP profile RTP/SAVP. This means that media channels (e.g. audio, video) must be secured via Secure RTP (SRTP), which provides media encryption among other security features. In fact, the use of plain (unencrypted) RTP is explicitly forbidden by the WebRTC specifications. ...  Continue reading