Unnamed videoconferencing server

Development of the Unnamed videoconferencing server has been stopped, as I am now working on Galène.

(Unnamed) is a videoconferencing server that is very easy to deploy (just copy a few files and run the binary) and that requires minimal server resources. It is suitable for one-on-one conversations and small multi-party discussions (up to 4 or 5 participants). For larger groups, please try Galène.

(Unnamed) was written for my own needs — it might, or might not, be suitable for you. Please contact me if there's a particular feature you find missing, it might be easy to add.

Installation

Please do

Server resources and scalability

(Unnamed) should be able to handle thousands of groups on a tiny server. Our demo server consumes 10MB of RAM and no measurable amount of CPU or network bandwidth.

On the other hand, since (unnamed) builds a full mesh between the participants in a group, the size of a single group is limited — expect communication to start breaking down around a half a dozen participants in a single discussion group, earlier if some participants have poor connectivity. For larger groups, please try Galène

Security model

Video, audio and chat data are peer-to-peer, and don't go through the server. They are cryptographically protected using the standard WebRTC mechanisms (DTLS-SRTP for media and DTLS for chat).

Key negotiation goes through the server, which is treated as an untrusted channel: key exchange is authenticated using a key derived from the user-provided passphrase salted with the group name (we use PBKDF2 with 10000 iterations as the key derivation function, and HMAC-SHA256 as the signature algorithm). The passphrase is erased as early as possible, and only the derived key is (persistently) stored in the browser.

Two caveats:

• this is Javascript, an attacker who controls the server is able to insert a backdoor in the code;
• I am not a security expert, and the code has never been reviewed for security flaws; I may have made mistakes.