Using ZRTP to Secure WebRTC
draft-johnston-rtcweb-zrtp-00
| Document | Type | Expired Internet-Draft (individual) | |
|---|---|---|---|
| Authors | Alan Johnston , Philip Zimmermann , Jon Callas , Travis Cross , John Yoakum | ||
| Last updated | 2014-03-03 (Latest revision 2013-08-22) | ||
| Stream | (None) | ||
| Formats |
Expired & archived
plain text
xml
htmlized
pdfized
bibtex
|
||
| Stream | Stream state | (No stream defined) | |
| Consensus boilerplate | Unknown | ||
| RFC Editor Note | (None) | ||
| IESG | IESG state | Expired | |
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
https://www.ietf.org/archive/id/draft-johnston-rtcweb-zrtp-00.txt
Abstract
WebRTC, Web Real-Time Communications, is a set of protocols and APIs used to enable web developers to add real-time communications into their web pages and applications with a few lines of JavaScript. WebRTC media flows are encrypted and authenticated by SRTP, the Secure Real-time Transport Protocol while the key agreement is provided by DTLS-SRTP, Datagram Transport Layer Security for Secure Real-time Transport Protocol. However, without some third party identity service or certificate authority, WebRTC media flows have no protection against a man-in-the-middle (MitM) attack. ZRTP, Media Path Key Agreement for Unicast Secure RTP, RFC 6189, does provide protection against MitM attackers using key continuity augmented with a Short Authentication String (SAS). This specification describes how ZRTP can be used over the WebRTC data channel to provide MitM protection for WebRTC media flows keyed using DTLS-SRTP. This provides users protection against MitM attackers without requiring browsers to support ZRTP or users to download a plugin or extension to implement ZRTP.
Authors
Alan Johnston
Philip Zimmermann
Jon Callas
Travis Cross
John Yoakum
(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)