Subject: [AVT] Keying SRTP store and forward

From: Rolf Blom J <[email-masked]>
Date: Wed, 19 Nov 2008 20:02:47 +0100

At my presentation yesterday, keying for e2e protection in connection
with voice mailboxes was discussed. I believe this discussion got a bit
confused as we were coming from differing starting points and we had
different views on what should and/or can be achieved.

I look at e2e protected mailboxes in a similar way as I consider secure
email. In secure email the sender exactly specifies the specific person
or group of persons he wants to send the email to, and a receiver can
only read his email if his secure email credentials are available in
the terminal he uses. I believe this is a feature of secure
email. If you want to have access to your email from any terminal (not
providing credentials for secure email) you have to rely on protected
transport of the plaintext email from the email server to the client.

Secure email is a valuable service used many private users and is also
a standard in many large organizations like enterprises, government
authorities etc. I believe that these user groups, appreciating secure
email, should also be offered the possibility to have e2e protected
voice (and multimedia) mailboxes. For this, the proposed extensions in
SRTP are needed.

Note that this work is not only (or perhaps even mainly) motivated by
the voice mailbox use case but also relates to the media distribution
use cases described in the draft.

Rolf Blom

Ericsson Research

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www.ietf.org/mailman/listinfo/avt

---

From: David R Oran <[email-masked]>
Date: Wed, 19 Nov 2008 13:13:12 -0600

But secure email is done with PGP or S/Mime, which does content  
crypto, not transport crypto. So I'm afraid I don't see the analogy.

On Nov 19, 2008, at 1:02 PM, Rolf Blom J wrote:

> At my presentation yesterday, keying for e2e protection in  
> connection with voice mailboxes was discussed. I believe this  
> discussion got a bit confused as we were coming from differing  
> starting points and we had different views on what should and/or can  
> be achieved.
>
> I look at e2e protected mailboxes in a similar way as I consider  
> secure email. In secure email the sender exactly specifies the  
> specific person or group of persons he wants to send the email to,  
> and a receiver can only read his email if his secure email  
> credentials are available in the terminal he uses. I believe this is  
> a feature of secure email. If you want to have access to your email  
> from any terminal (not providing credentials for secure email) you  
> have to rely on protected transport of the plaintext email from the  
> email server to the client.
>
> Secure email is a valuable service used many private users and is  
> also a standard in many large organizations like enterprises,  
> government authorities etc. I believe that these user groups,  
> appreciating secure email, should also be offered the possibility to  
> have e2e protected voice (and multimedia) mailboxes. For this, the  
> proposed extensions in SRTP are needed.
>
> Note that this work is not only (or perhaps even mainly) motivated  
> by the voice mailbox use case but also relates to the media  
> distribution use cases described in the draft.
>
> Rolf Blom
> Ericsson Research
>
>
>

---

From: "Rolf Blom J" <[email-masked]>
Date: Wed, 19 Nov 2008 22:30:06 +0100

The analogy is that the e2e protection in SRTP corresponds to the
content encryption in secure email and the hbh protection gives
transport protection. So SRTP combines both. That the basic idea.

Rolf 

-----Original Message-----
From: David R Oran [mailto:[email-masked]] 
Sent: den 19 november 2008 20:13
To: Rolf Blom J
Cc: AVT
Subject: Re: [AVT] Keying SRTP store and forward

But secure email is done with PGP or S/Mime, which does content crypto,
not transport crypto. So I'm afraid I don't see the analogy.

On Nov 19, 2008, at 1:02 PM, Rolf Blom J wrote:

> with voice mailboxes was discussed. I believe this discussion got a 
> bit confused as we were coming from differing starting points and we 
> had different views on what should and/or can be achieved.
>
> specific person or group of persons he wants to send the email to, and

> a receiver can only read his email if his secure email credentials are

> available in the terminal he uses. I believe this is a feature of 
> secure email. If you want to have access to your email from any 
> terminal (not providing credentials for secure email) you have to rely

> on protected transport of the plaintext email from the email server to

> the client.