Application-Layer Protocol Negotiation (ALPN) for WebRTC
Extracted elements (19)
Confidentiality protections under 'c-webrtc' explicitly do not extend to data channel messages, only to media, because no mechanisms currently exist to enforce data confidentiality end-to-end.
The ALPN approach separates control (signaling) capabilities from media access, enabling an application to manage signaling for a session without having access to the media exchanged, achieving end-to-end confidentiality between user agents rather than between signaling endpoints.
The ALPN identifier for 'c-webrtc' provides a signal securely bound to the DTLS session to distinguish confidential sessions from non-confidential ones; without it, a WebRTC endpoint cannot properly distinguish between the two.
The 'webrtc' and 'c-webrtc' ALPN labels cover the same underlying protocol (DTLS for SRTP keys and/or SCTP data channels); either SRTP or data channels may be absent in a given session. ICE (RFC 8445) is required for UDP flow establishment but is not covered by the ALPN identifier.
A peer in the client role MUST offer both 'webrtc' and 'c-webrtc' ALPN identifiers if it is not aware of a need for confidentiality.
A peer in the server role SHOULD select 'webrtc' if it does not prefer either ALPN identifier.
A peer MUST NOT assume that 'c-webrtc' has been negotiated unless explicitly negotiated via ALPN.
A peer willing to accept 'webrtc' SHOULD assume that a peer not supporting this specification has negotiated 'webrtc' unless signaling provides other information.
A WebRTC endpoint that accepts a session with the 'c-webrtc' ALPN identifier MUST respect confidentiality regardless of what identity is attributed to a peer.
An endpoint MUST abort a session if it requires confidentiality but does not successfully negotiate 'c-webrtc'.
Any entity that forwards or records content for later access by entities other than the authenticated peer MUST NOT offer or accept a session with the 'c-webrtc' identifier.
Media produced from a session using the 'c-webrtc' identifier MUST only be displayed to users; browsers must enforce this via isolation controls similar to cross-origin content protections.
Two ALPN labels are defined for WebRTC: 'webrtc' identifies a DTLS session used for DTLS-SRTP key establishment and/or data channels over SCTP; 'c-webrtc' identifies the same protocol but with an additional promise to maintain media confidentiality.
Two entries added to the IANA 'TLS Application-Layer Protocol Negotiation (ALPN) Protocol IDs' registry: 'webrtc' for WebRTC Media and Data, and 'c-webrtc' for Confidential WebRTC Media and Data, both specified by RFC 8833.
On shared computing platforms, other web applications with access to microphones or cameras may be able to sample confidential audio or video. Implementations MAY choose to limit concurrent access to input devices during confidential communication sessions.
Peer authentication (per RFC 8827) is necessary to ensure data is only sent to the intended peer; without it, confidential communications cannot be guaranteed even with 'c-webrtc' negotiated.
The 'c-webrtc' mechanism is not a digital rights management system; users are not prevented from using screen recorders, tape recorders, cameras, or other means to capture and redistribute media once delivered.
The 'c-webrtc' ALPN identification sequence is 0x63 0x2d 0x77 0x65 0x62 0x72 0x74 0x63 (8 bytes, ASCII 'c-webrtc').
The 'webrtc' ALPN identification sequence is 0x77 0x65 0x62 0x72 0x74 0x63 (6 bytes, ASCII 'webrtc').