4 ms·

The JS code is under 500 lines so this is at least simple and auditable. I didn't see anything about encryption based on a cursory read. Does WebRTC have some

The JS code is under 500 lines so this is at least simple and auditable. I didn't see anything about encryption based on a cursory read. Does WebRTC have some built in or is this unencrypted?

kelnos 6y ago
WebRTC requires DTLS (the UDP version of TLS) for the media streams; it doesn't even allow unencrypted. The signaling for call setup / maintenance / teardown can be whatever, though. It looks like this uses socket.io with HTTPS long-polling. So you need a publicly-addressable IP (or a proxy service like ngrok) in order to host this yourself. Assuming you host it yourself, all clients should have encrypted signaling with your server, and encrypted voice/video packets between each other. If someone else hosts it for you, they can see your signaling traffic, but -- unless they change the code to forward the media stream elsewhere in order to MitM it -- your media should still be encrypted. However, this does make use of public STUN servers to help with NAT/firewall hole punching, which will leak your IP addresses and possibly make it so an adversary can figure out the IPs of the people who were talking to each other, based on the timing of connections. There are also public TURN servers listed which will act as media relays if the NAT traversal fails. Usually the TURN servers are dumb packet forwarders and won't terminate the DTLS sessions, so that should be fine, but I don't remember how the protocol works well enough (it's been a good 7 years since I was knee-deep in this stuff) to say that for certain.
- algesten 6y ago
  DTLS is only the first part of the encryption. The actual media is transferred of SRTP which is encrypted RTP. DTLS provides the keying material to derive keys for SRTP. DTLS is however fully used for SCTP, which the protocol for data channels alongside the media streams.
  - kelnos 6y ago
    Yes, I'm aware (I've implemented a WebRTC stack before); I didn't think diving into the finer details of SRTP would be necessary at this point.

The JS code is under 500 lines so this is at least simple and auditable. I didn't see anything about encryption based on a cursory read. Does WebRTC have some built in or is this unencrypted?

kelnos 6y ago

WebRTC requires DTLS (the UDP version of TLS) for the media streams; it doesn't even allow unencrypted. The signaling for call setup / maintenance / teardown can be whatever, though. It looks like this uses socket.io with HTTPS long-polling. So you need a publicly-addressable IP (or a proxy service like ngrok) in order to host this yourself. Assuming you host it yourself, all clients should have encrypted signaling with your server, and encrypted voice/video packets between each other. If someone else hosts it for you, they can see your signaling traffic, but -- unless they change the code to forward the media stream elsewhere in order to MitM it -- your media should still be encrypted. However, this does make use of public STUN servers to help with NAT/firewall hole punching, which will leak your IP addresses and possibly make it so an adversary can figure out the IPs of the people who were talking to each other, based on the timing of connections. There are also public TURN servers listed which will act as media relays if the NAT traversal fails. Usually the TURN servers are dumb packet forwarders and won't terminate the DTLS sessions, so that should be fine, but I don't remember how the protocol works well enough (it's been a good 7 years since I was knee-deep in this stuff) to say that for certain.

algesten 6y ago
DTLS is only the first part of the encryption. The actual media is transferred of SRTP which is encrypted RTP. DTLS provides the keying material to derive keys for SRTP. DTLS is however fully used for SCTP, which the protocol for data channels alongside the media streams.
- kelnos 6y ago
  Yes, I'm aware (I've implemented a WebRTC stack before); I didn't think diving into the finer details of SRTP would be necessary at this point.