Expand description
Certificate fingerprints and the TLS role, in SDP (RFC 8122, RFC 4145).
This is the half of DTLS-SRTP that travels in the signalling. The key never does — that is the
entire point, and the difference from SDES (crate::crypto, RFC 4568), where the key is the
SDP. Here the SDP carries only a hash of the certificate that will appear on the media path,
so a proxy or session border controller that terminates the TLS learns nothing it can decrypt
with. What it can do is substitute a fingerprint of its own; RFC 8122 §7 is clear that the
mechanism’s guarantee is therefore only as good as the integrity of the signalling.
The check is not optional. RFC 8122 §6.2: an endpoint whose peer’s certificate “does not match
the original fingerprint” MUST “terminate the media connection with a bad_certificate error”. A
stack that sends a fingerprint and does not verify one has implemented the decoration and not
the mechanism.
Structs§
- Fingerprint
- One
a=fingerprintvalue (RFC 8122 §5). - Setup
Capabilities - DTLS roles the local handshake implementation can hold.
Enums§
- Hash
Func - The hash a fingerprint was taken with (RFC 8122 §5).
- Setup
- Who opens the DTLS connection (RFC 4145 §4, used by RFC 5763 §5).
- Setup
Role Error - A DTLS setup exchange that cannot select a local handshake role.