Subject: RE: Does GEOPRIV specify crypto was RE: Notes from Non-meeting

From: "Rosen, Brian" <[email-masked]>
Date: Wed, 20 Mar 2002 11:49:06 -0500

On the contrary, I think the trust association between the
two UAs that the SIP mechanism provides is exactly what 
is appropriate to protect location information.

Brian

> -----Original Message-----
> From: Randy Bush [mailto:[email-masked]]
> Sent: Wednesday, March 20, 2002 11:43 AM
> To: Rosen, Brian
> Cc: [email-masked]
> Subject: Re: Does GEOPRIV specify crypto was RE: Notes from 
> Non-meeting
> 
> 
> >> i suspect that the trust association(s) of the transport will not
> >> be the same as the trust association(s) of the material being
> >> transported.  i am told that this little difference often raises
> >> its head.
> >>
> > SIP needs to provide location information for a number of
> > useful applications.
> > 
> > SIP Provides a way to authenticate, and provide confidentiality
> > for SIP messages between two end user devices (UAs).  
> > We propose to place the location object in the SIP message.
> > We assert that the mechanisms in SIP (the new version recently
> > approved by the IESG) are sufficient for the purpose.
> 
> i suspect that the trust association(s) of the transport will not
> be the same as the trust association(s) of the material being
> transported.  i am told that this little difference often raises
> its head.
> 
> randy
>

---

From: Randy Bush <[email-masked]>
Date: Wed, 20 Mar 2002 10:57:07 -0600

> is appropriate to protect location information.

oh, i understood that you did.  security clue will be coming.
patience.

randy

---

From: Henning Schulzrinne <[email-masked]>
Date: Wed, 20 Mar 2002 11:10:06 -0600

To amplify what Brian said: the important part is which identifier
location information is associated with. In SIP, it would be associated
with the SIP 'From' identifier and be directed to the 'To' identifier.
It makes sense to have authentication reflect this identity - which is
exactly what would be happening, but may not if the two pieces are split
apart. There is no fundamental difference between the location property
of [email-masked] and other properties that are carried around, such
as the Organization, Call-Info, display-name or User-Agent information.

In other words, the only thing that matters is the principal that the
location information describes.