Short Q&A transcript from a YouTube video by Tsahi Levent-Levi discussing which encryption standards WebRTC uses: DTLS (currently 1.2, moving to 1.3) for key negotiation and handshake, SRTP for media with symmetric keys (typically 128-bit, optionally 256-bit), and AES as the encryption algorithm; signaling occurs over HTTPS or secure WebSocket and is out of WebRTC scope.
What encryption standards does WebRTC use?
So WebRTC uses DTLs and DTLs SRTP to negotiate the encryption keys. DTLs. It's currently DTLs 1.2. Chrome is rolling out DTLs 1.3 which is going to be important moving forward because then it gives you something called post quantum cryptography support, which is going to be important in the next five years. And that means even quantum computers will not be able to break the encryption, which will be good. And from there we have dtls, which is basically TLS over a lossy transport and that derives. That encrypts the data channel messages and it does a handshake that sets up the keys for SRTP. And the keys for SRTP are symmetric keys, typically 128 bit keys. There are ways to negotiate 256 keys, but the IETF doesn't require you to. And I've seen people ask for it, but mostly for bullshit compliance stuff.
Yes, healthcare organizations usually ask for it and then you see servers that just support that.
Yes, but I mean the ITF doesn't tell you 128 is bad in this scenario. It's just some compliance requirements. As 128 keys are bad. They aren't this bad keys.
What is the encryption algorithm that they use at the end of the day?
Good question. AES. Yep.
So we have AES used for srtp. And then there is also the fact that we need signaling that is out of scope of WebRTC and that happens on top of HTTPs or secure WebSocket with whatever encryption standards that we have there.
But that's typically encrypted with a signaling server, not with a peer.
Yep. Okay. Thank you.
Thank you.
Meta rebuilt AV1 for mobile scale. Should smaller teams follow? | Chats with Arin
