4 ms·

I know webrtc works p2p when possible and does some form of encryption, but I didn't know it claims e2e encryption. Is this for real, like, any standard browser

• supermatt 7y ago
  Heres some information: https://rtcweb-wg.github.io/security-arch/#rfc.section.4.3 https://rtcweb-wg.github.io/security-arch/#rfc.section.4.3 I dont believe there is a way to retrieve the keys via javascript, but you can get a fingerprint from the SessionDescription. These fingerprints are used to validate the certificates during the DTLS handshake, so displaying those should be sufficient for manual verification. Note that there may be multiple independently encrypted streams per peer, so you may have to display a few. Its not quite as simple as a single fingerprint, usually. I think this is probably an artifact of deriving the SRTP key from the DTLS key. I would much prefer the option to manage SRTP encryption keys independently, which would simplify this somewhat.
• kreetx 7y ago
  Yes, webrtc when done in p2p/mesh, is end-to-end encrypted, even when using TURN servers in between (these are relay servers when direct p2p is not possible). Unfortunately mesh doesn't work out well when it's a conference call (many callers), so MCUs, SFUs, etc come to play.