Subject: [AVT] secure avt

From: "John Cumbo" <[email-masked]>
Date: Wed, 14 Jan 2004 14:30:30 -0500

Hello,

my question has to do with secure avt. I am a network analyst for a hospital
IS department, and we are implementing a distance learning center. Part of
my responsibility will be securing AV transmissions between our learning
center and other sites, and I suppose this is a very general request for the
status of things like using SRTP for doing this. My concerns are centered
upon HIPAA and how that governing body will affect these types of data
transmissions. Is there any currently accepted standard for doing this type
of thing? Is SRTP a current accepted standard for doing this? Or is this
part of what the AVT task force is developing.

Any input would be appreciated

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt

---

From: Mark Baugher <[email-masked]>
Date: Thu, 15 Jan 2004 08:20:39 -0800

John,
    SRTP soon will be an Internet Proposed Standard.  It very well may be 
the right choice for securing your application, all things being 
equal.  You will need to have an authorization and key management 
infrastructure to support an SRTP product.

    You should also consider various alternatives.  One alternative is 
IPsec, which secures UDP and has been successful in providing 
confidentiality and/or authentication for media streams for many 
applications.  SRTP is quite new and there are lots of IPsec-based products 
but fewer SRTP-based products at the present time.  You might choose IPsec 
over SRTP if you want to have an IPsec VPN among your sites and don't need 
any of the features that SRTP has over IPsec, such as the following.

   1. SRTP allows compressed RTP and has much less packet overhead than IPsec.
   2. SRTP provides application-layer security, which is more secure for 
some applications particularly when multi-user computers are used as end 
systems.
   3. SRTP is tailored to RTP and supports, for example, encrypted RTP with 
unencrypted RTCP flows.

Mark