Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am having a thought experiment. Can you help me?

  • Two clients who both use PGP.
  • They initiate a WebRTC call using DTLS-SRTP via a 3rd party server.

Is there any benefit of encrypting, via their PGP, the handshaking ...

  • Q1: ... when the communication is peer 2 peer.
  • Q2: ... when relay server is required due to routing issues.

I think both will be beneficial, but Q1 hardly, Q2 on the other hand maybe more worthwhile?

Thanks, Paul.

share|improve this question

1 Answer 1

up vote 4 down vote accepted

DTLS-SRTP builds on DTLS which applies its own encryption layer. The handshake, by construction, is done outside of any encryption, and that's fine.

"Relay servers" are a red herring. The two clients will talk to each other by sending data packets which will go through a number of other systems. Whether you consider some of these systems as "routers" or as "relays" does not matter; security properties ensured by TLS (and DTLS) don't depend on the actual transport method.

Inserting PGP keys in the mixture does any good only if you want to use these keys as basis for authentication. This is theoretically possible, meaning that the protocol has been defined -- but it remains to be actually implemented and deployed. With this support, the X.509-based certificates of SSL are replaced with PGP public keys; this maps to DTLS as well. Getting rid of X.509 certificates is a good idea if you have other means to achieve mutual authentication, and PGP keys can be such means, as RFC 6091 describes.

share|improve this answer
    
Thank you for your excellent answer. I have two follow ups... 1. Would a benefit of using PGP for authentication be that you can also verify the other ends identity? More trusted than self signed and arguably more trusted than CA signed now days (post lavabit). You may not know the person you are dealing with, but you know their public key is at least who you believe to be the person you are contacting. 2. Is there a downside to using PGP instead (in a closed environment where compatibility isn't required), the RFC appears to suggest no additional issues? –  Paul Oct 18 '13 at 8:01
1  
A public key is a public key. In TLS (and DTLS), the "server" shows a public key (and uses the corresponding private key), and the "client" may also show a public key (and uses the corresponding private key). X.509, PGP... are PKI: ways to make sure that the public key you see is really owned by whom you believe. Benefit of using PGP is in a context where you have PGP keys and you have some ways (Web of Trust, prior knowledge) to guarantee mappings of keys to identities. –  Thomas Pornin Oct 18 '13 at 11:04
    
Great, thank you. In my case, PGP is known and shared prior so seems to be a good use case. Thank you for your assistance and understanding. –  Paul Oct 18 '13 at 20:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.