V53 Cryptographic requirements for WebRTC

[randomstuff]

Spinoff of #2215.

Is there any need for cryptographic requirements for WebRTC channels?

Possible topics:

• forward secrecy;
• peer authentication;
• encryption method/ciphersuites.

I would not expect much verification would be needed in practice. Maybe when a backend server acts as a WebRTC peer?

References

WebRTC requires Perfect Forward Secrecy (PFS) starting in Firefox 38 indicates that forward secrecy was not always enabled.

WebRTC Security: What You Need to Know in 2021 seems to imply that it is (was) not always automatic.

RFC8826:

It is this consideration that makes an automatic, public key-based key exchange mechanism imperative for WebRTC (this is a good idea for any communications security system), and this mechanism SHOULD provide Forward Secrecy (FS). The signaling channel/calling service can be used to authenticate this mechanism.

RFC8827:

Implementations MUST favor cipher suites which support Forward Secrecy (FS) over non-FS cipher suites and SHOULD favor Authenticated Encryption with Associated Data (AEAD) over non-AEAD cipher suites. .

[randomstuff]

ping @tghosth