STIR Passport objects in WebRTC Indentity

I've been looking at how WebRTC Identity and STIR work together and put together a worked out example at 

http://www.ietf.org/id/draft-jennings-stir-rtcweb-identity-00.txt

WebRTC is very flexible about supporting lots of different identity assertion. The STIR WG has been developing an identity asserted called passport (nothing to do with MS passport). One thing that comes up when using them with WebRTC is in the call to pc.setIdentityProvider. It would be really nice to have an optional parameter to the pc.setIdentityProvider that could provide the list of destination addresses. 

For many identity services, having the ability to include the destination user in the assertion improves security because it eliminates some of the sort of cut and paste attacks where an attacker takes a session from Alice to Bob, and instead sends it to Charlie or a even a huge number of other people. If the destination (bob) is not included in assertion, there is no way for Charlie to know that Alice meant to call Bob and got redirected to Charlie before Charlie forms the connection. 

To support identity services that want to include the destination, I think we should extend the pc.setIdentityProvider API to include an optional destinationHint that is very similar to existing usernameHint. Having that would improve WebRTC working with STIR identity and would also help other identity systems.

Received on Monday, 9 May 2016 21:20:59 UTC