|
@@ -3,6 +3,7 @@
|
3
|
3
|
## Overview
|
4
|
4
|
|
5
|
5
|
**NOTE** e2ee is work in progress.
|
|
6
|
+
|
6
|
7
|
This document describes some of the high-level concepts and outlines the design.
|
7
|
8
|
Please refer to the source code for details.
|
8
|
9
|
|
|
@@ -56,7 +57,7 @@ At a high level the encrypted frame format looks like this:
|
56
|
57
|
+^+-------------------------------------------------------+ +
|
57
|
58
|
| | Authentication Tag | |
|
58
|
59
|
| +---------------------------------------+-+-+-+-+-+-+-+-+ |
|
59
|
|
- | | CTR... (length=LEN + 1) |S|LEN |KID | |
|
|
60
|
+ | | CTR... (length=LEN + 1) |R|LEN |KID | |
|
60
|
61
|
| +---------------------------------------+-+-+-+-+-+-+-+-+^|
|
61
|
62
|
| |
|
62
|
63
|
+----+Encrypted Portion Authenticated Portion+---+
|
|
@@ -64,52 +65,12 @@ At a high level the encrypted frame format looks like this:
|
64
|
65
|
|
65
|
66
|
We do not encrypt the first few bytes of the packet that form the
|
66
|
67
|
[VP8 payload](https://tools.ietf.org/html/rfc6386#section-9.1) (10 bytes for key frames, 3 bytes for interframes) nor
|
67
|
|
-the [Opus TOC byte](https://tools.ietf.org/html/rfc6716#section-3.1)
|
|
68
|
+the [Opus TOC byte](https://tools.ietf.org/html/rfc6716#section-3.1).
|
|
69
|
+
|
68
|
70
|
This allows the decoder to understand the frame a bit more and makes it decode the fun looking garbage we see in the
|
69
|
71
|
video. This also means the SFU does not know (ideally) that the content is end-to-end encrypted and there are no
|
70
|
72
|
changes in the SFU required at all.
|
71
|
73
|
|
72
|
|
-If the signature bit is set on the frame trailer, there is an additional fixed-length signature that is located
|
73
|
|
-between the counter and the trailing bit:
|
74
|
|
-```
|
75
|
|
- +------------+------------------------------------------+^+
|
76
|
|
- |unencrypted payload header (variable length) | |
|
77
|
|
- +^+------------+------------------------------------------+ |
|
78
|
|
- | | | |
|
79
|
|
- | | | |
|
80
|
|
- | | | |
|
81
|
|
- | | | |
|
82
|
|
- | | Encrypted Frame | |
|
83
|
|
- | | | |
|
84
|
|
- | | | |
|
85
|
|
- | | | |
|
86
|
|
- | | | |
|
87
|
|
- +^+-------------------------------------------------------+ +
|
88
|
|
- | | Authentication Tag | |
|
89
|
|
- | +---------------------------------------+-+-+-+-+-+-+-+-+ |
|
90
|
|
- | | CTR... (length=LEN + 1) | SIGNATURE | |
|
91
|
|
- | +---------------------------------------+-+-+-+-+-+-+-+-+ |
|
92
|
|
- | | SIGNATURE (fixed length) |1|LEN |KID | |
|
93
|
|
- | +---------------------------------------+-+-+-+-+-+-+-+-+^|
|
94
|
|
- | |
|
95
|
|
- +----+Encrypted Portion Authenticated Portion+---+
|
96
|
|
-```
|
97
|
|
-
|
98
|
|
-The signature is generated as
|
99
|
|
- Signature = Sign(signatureKey, Authentication Tag)
|
100
|
|
-and covers the current frame. Not every frame is signed but there will be periodic
|
101
|
|
-signatures on all SSRCs and streams. This prevents the impersonation attacks described in
|
102
|
|
- https://tools.ietf.org/html/draft-omara-sframe-00#section-4.4
|
103
|
|
-We currently sign every frame, despite the overhead this incurs.
|
104
|
|
-
|
105
|
|
-We currently use ECDSA with curve P-521 as described on
|
106
|
|
- https://developer.mozilla.org/en-US/docs/Web/API/EcKeyGenParams
|
107
|
|
-and sign/verify with SHA-256:
|
108
|
|
- https://developer.mozilla.org/en-US/docs/Web/API/EcdsaParams
|
109
|
|
-This results in a fixed length signature of 132 bytes.
|
110
|
|
-We plan to make these options negotiable by exchanging them along with the key as a JWK:
|
111
|
|
- https://tools.ietf.org/html/rfc7517
|
112
|
|
-
|
113
|
74
|
### Using Web Workers
|
114
|
75
|
|
115
|
76
|
Insertable Streams are transferable and can be sent from the main JavaScript context to a
|