Subject: [Ecrit] some LOST and HELD questions

From: Klaus Darilion <[email-masked]>
Date: Mon, 28 Aug 2006 17:22:06 +0200

Hi all!

I'm rather new to the ecrit topics, thus please excuse if my questions 
were already discussed and point me to the answers.

Question 1: LOST and location-by-reference
In a SIP client, the emergency call scenario typically consists of:
1. perform a HELD query to obtain the location
2. perform a LOST query to obtain the PSAP's URI
3. call the PSAP's URI including the obtained location

If I got it right, step 1 and 3 allow either location-by-value and 
location-by-reference whereas step 2 only uses location-by-value. Thus, 
the SIP client has to fetch the location although it uses 
location-by-reference in step 1 and 3. Is it planned to extend LOST to 
support location-by-reference as well?

Question 2: TLS and certificate validation
Both, LOST and HELD suggest to use TLS. If this is only for encryption 
this is fine. If it is also for authentication things get complex. The 
client (1.) needs the certificates of trusted root CAs and (2.) has to 
validate the CN (or subjectAlternative) against the HELD/LOST URI. When 
considering hard phones, which should work for decades without the need 
for updating the root certs, this wont work. Thus I would like to have 
some more explicit instructions on certificate validation (yes or no) 
when suggesting TLS.

Question 3: "On behalf" HELD queries
If a stupid SIP client performs an emergency call, the SIP proxy may 
perform the HELD/LOST queries on behalf of the SIP client. Thus, the SIP 
proxy has to signal an identifier of the SIP client (e.g. IP address). 
Is there such an identifier defined in the HELD query? I couldn't find 
one in section 5 of the HELD draft.

thanks
Klaus

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 28 Aug 2006 17:41:26 +0200

Hi Klaus,

I will only respond to the LoST questions since the HELD questions 
should be targeted to the Geopriv working group.

Klaus Darilion schrieb:
> location-by-reference whereas step 2 only uses location-by-value.

True.

  Thus,
> support location-by-reference as well?

We had this discussion and we decided to go for location-per-value in 
LoST only.

> this is fine. If it is also for authentication things get complex. 

In case of LoST it is meant to be used for sever-side authentication, 
i.e., the LoST server is authenticated to the LoST client.

This is necessary to mitigate some man-in-the-middle attacks.

The
> validate the CN (or subjectAlternative) against the HELD/LOST URI.

Right.

  When
> some more explicit instructions on certificate validation (yes or no) 

We are certainly going to update the security consideration of the LoST 
draft.

Legacy IP phones will not have LoST implemented and hence the issue will 
not appear.

> one in section 5 of the HELD draft.

Ciao
Hannes

---

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 28 Aug 2006 11:41:10 -0400

> 1. perform a HELD query to obtain the location

There has been no decision within the working group to use HELD or any 
other specific protocol. The L7 design team is identifying requirements 
and there are at least two proposals for such a protocol, including RELO 
and HELD.

Other mechanisms that don't involve references are obviously also 
possible and likely.

> support location-by-reference as well?

This has been discussed; please consult the archives. You can also take 
a look at the requirements document.

See Lo2 in 
http://www.cs.columbia.edu/sip/draft/ecrit-requirements/draft-ietf-ecrit-requirements-12.html

> some more explicit instructions on certificate validation (yes or no) 

I'm not quite sure I understand the concern. Hard (Ethernet) phones are 
routinely updated today. The one on my desk checks periodically whether 
it needs to get a new image, for example.

> one in section 5 of the HELD draft.

Again, HELD and LoST are completely independent. LoST does not require 
the use of HELD (or any other specific protocol).

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 28 Aug 2006 17:41:26 +0200

Hi Klaus,

True.

  Thus,

The

Right.

  When

Ciao
Hannes

---

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 28 Aug 2006 11:41:10 -0400

See Lo2 in

---

From: Andrew Newton <[email-masked]>
Date: Mon, 28 Aug 2006 11:48:35 -0400

> 3. call the PSAP's URI including the obtained location

Step 1 may occur via other means, too.  The client may get its location via 
DHCP or LLPD-MED.  Additionally, HELD has been quite controversial and has 
not been picked as "the" layer 7 location configuration protocol. 
Currently, the GEOPRIV working group has a design team working on the 
requirements for such a protocol.  And there are at least two other 
proposals for a layer 7 location configuration protocol (L7-LCP): 
draft-linsner-geopriv-lcp and draft-schulzrinne-geopriv-relo.

> support location-by-reference as well?

I don't see a need for LoST to do this.  LoST server exist as resolvers, 
forest guides, and authoritative servers.  The location must be known at the 
first step, so putting it in as a reference would do no good.

> some more explicit instructions on certificate validation (yes or no) 

If used with an emergency call, I think if cert validation fails then it 
should be ignored if the TLS stack allows that (depends on the failure and 
the TLS library).  If the failure does not allow further communication via 
HTTPS, the query should be retried over HTTP.

> one in section 5 of the HELD draft.

I don't understand this, but that is certainly nothing new.

-andy

---

From: "Tschofenig, Hannes" <[email-masked]>
Date: Mon, 28 Aug 2006 17:56:36 +0200

Klaus, 

I think that the ECRIT framework document is also useful reading:
http://tools.ietf.org/wg/ecrit/draft-rosen-ecrit-framework-00.txt

Ciao
Hannes

> -----Ursprüngliche Nachricht-----
> Von: Andrew Newton [mailto:[email-masked]] 
> Gesendet: Montag, 28. August 2006 17:49
> An: Klaus Darilion
> Cc: [email-masked]; [email-masked]
> Betreff: Re: [Ecrit] some LOST and HELD questions
> 
> Klaus Darilion wrote:

---

From: Klaus Darilion <[email-masked]>
Date: Mon, 28 Aug 2006 18:38:59 +0200

Hannes Tschofenig wrote:
>> When
>> considering hard phones, which should work for decades without the 
>> need for updating the root certs, this wont work. Thus I would like to 
>> have some more explicit instructions on certificate validation (yes or 
>> no) when suggesting TLS.
> 

Hi Hannes!

I was thinking about my SIPURA and Grandstream VoIP adapters I use at 
home. I bought them 2 years ago and they still run with the original 
firmware. If they would have root certificates included probably some of 
them would be expired. It would be bad if an emergency call would fail 
because of a certificate validation error.

regards
klaus

---

From: Klaus Darilion <[email-masked]>
Date: Mon, 28 Aug 2006 18:47:45 +0200

Henning Schulzrinne wrote:
>> When considering hard phones, which should work for decades without 
>> the need for updating the root certs, this wont work. Thus I would 
>> like to have some more explicit instructions on certificate validation 
>> (yes or no) when suggesting TLS.
> 

Hi Henning!

Indeed, routinely updated phones are common in enterprise scenarios. But 
in the end home user market I think automatic updates of SIP phones are 
not that usual. Further, there might be the problem that the CA which 
signed the servers certificate is not in the phone's list of trusted 
CAs. IMO it would be bad if an emergency call fails due to failed 
certificate validation.

regards
Klaus

---

From: Klaus Darilion <[email-masked]>
Date: Mon, 28 Aug 2006 18:50:15 +0200

Hi!

Thanks to all for the clarifications and pointing to the relevant documents.

regards
klaus

Andrew Newton wrote:
> Step 1 may occur via other means, too.  The client may get its location 
> via DHCP or LLPD-MED.  Additionally, HELD has been quite controversial 
> and has not been picked as "the" layer 7 location configuration 
> protocol. Currently, the GEOPRIV working group has a design team working 
> on the requirements for such a protocol.  And there are at least two 
> other proposals for a layer 7 location configuration protocol (L7-LCP): 
>> Thus, the SIP client has to fetch the location although it uses 
> forest guides, and authoritative servers.  The location must be known at 
> the first step, so putting it in as a reference would do no good.
> 
> should be ignored if the TLS stack allows that (depends on the failure 
> and the TLS library).  If the failure does not allow further 
> communication via HTTPS, the query should be retried over HTTP.
> 
>> perform the HELD/LOST queries on behalf of the SIP client. Thus, the 
>> SIP proxy has to signal an identifier of the SIP client (e.g. IP 
>> address). Is there such an identifier defined in the HELD query? I 
>> couldn't find one in section 5 of the HELD draft.
>

---

From: Andrew Newton <[email-masked]>
Date: Mon, 28 Aug 2006 13:29:25 -0400

> CAs. IMO it would be bad if an emergency call fails due to failed 

I can't speak for the other ITSPs, but we routinely upgrade the images on 
the hardware we have given our customers.

-andy

---

From: "Brian Rosen" <[email-masked]>
Date: Mon, 28 Aug 2006 13:39:27 -0400

The documents would say that if an authentication request fails, try the
larger transaction again without security.  It is not acceptable to fail an
emergency call.

I think the problem you raise is interesting, and I think we will need to
cover the issue in -framework and -phonebcp.  The phones will need a
mechanism to update the CA certs.  

Has anyone heard of a cert update process which uses the current cert to
protect something that claims to be an update of the cert?  

Brian

> -----Original Message-----
> From: Klaus Darilion [mailto:[email-masked]]
> Sent: Monday, August 28, 2006 12:48 PM
> To: Henning Schulzrinne
> Subject: Re: [Ecrit] some LOST and HELD questions
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 28 Aug 2006 20:27:00 +0200

I guess you might also want to update your firmware from time to time 
(as I do it with my mobile phone as well).

If you want new features then you might consider running an update.

Ciao
Hannes

Klaus Darilion schrieb:
>>> need for updating the root certs, this wont work. Thus I would like 
>>> to have some more explicit instructions on certificate validation 
>> We are certainly going to update the security consideration of the 
>> LoST draft.
>>
>> Legacy IP phones will not have LoST implemented and hence the issue 
>> will not appear.
> 
> Hi Hannes!
>

---

From: Klaus Darilion <[email-masked]>
Date: Tue, 29 Aug 2006 11:50:20 +0200

> If you want new features then you might consider running an update.

Of course guys like you and me we will do that. But a normal customer, 
which has no glue if a phone is a SIP phone or an analog phone, wont do 
that.

regards
klaus