RE: Plan for moving forward

["Dan Wing" <dwing@xxxxxxxxx>]

I don't understand your reference to PKI.

As was explained at length -- I thought -- in Prague, DTLS-SRTP does not
require (nor recommend) that the endpoint's certificate (used for DTLS-SRTP)
be made available in any kind of certificate store ("PKI"), anywhere, by
anybody.  Taken to an extreme, One Might Say that a new certificate could be
created by the endpoints for every DTLS-SRTP call, if the endpoint was
interested in doing such a thing.

-d

> -----Original Message-----
> From: owner-ietf-rtpsec@xxxxxxxxxxxx 
> [mailto:owner-ietf-rtpsec@xxxxxxxxxxxx] On Behalf Of 
> Lakshminath Dondeti
> Sent: Tuesday, June 12, 2007 12:48 PM
> To: Eric Rescorla
> Cc: Matt Lepinski; ietf-rtpsec@xxxxxxx
> Subject: Re: Plan for moving forward
> 
> 
> Eric,
> 
> I have double checked with people about where things are in 3GPP and 
> 3GPP2 and since you care to know the details, it is a 
> somewhat complex 
> story (actually not that complex).  If DRM is involved, there 
> are client 
> certs, PKI and everything (although in case of broadcast TV, 
> the story 
> is different, the mobile operators may be trying to do away 
> with PKIs in 
> that context).  But, clearly there is someone to pay for it 
> so to speak; 
> content business is a value-add.
> 
> For other purposes, people tell me that there were attempts 
> in the past 
> and they went no where (I haven't seen them and so I don't know the 
> story for sure).  Someone could try to make a proposal and build 
> consensus now; the burden then is on the merits of the proposal.  It 
> doesn't hurt too much is not an incentive.
> 
> There are folks on this list who also contribute to PP and 
> PP2.  If you 
> disagree with my notes above, please do let us know.
> 
> regards,
> Lakshminath
> 
> On 6/7/2007 12:04 PM, Eric Rescorla wrote:
> > At Thu, 07 Jun 2007 11:26:44 -0700,
> > Lakshminath Dondeti wrote:
> >>
> >> Thanks Matt.  I know of cases where skipping the 
> self-signed cert on the 
> >> UAC side would be considered necessary.  Broadly speaking whereas 
> >> verifying server-side certs as in case of https is 
> alright, client-side 
> >> certs, self-signed or not, are not really viable at the moment.
> > 
> > Can you provide more support for this claim?
> > 
> > The problems with client auth in HTTPS are almost entirely due
> > to user interface, but in the of DTLS-SRTP, they client auth
> > is hidden under the covers of the implementation and so this
> > is not an issue.
> > 
> > -Ekr
> > 
> >