Subject: [P2PSIP] Question: Security issue resp. RELOAD and SIP usage draft-ietf-p2psip-sip-00

From: Frédéric-Philippe Metz <[email-masked]>
Date: Sun, 15 Mar 2009 10:35:46 +0100

Hi all,

RELOAD with SIP Usage is for setting up a direct connection between Alice
and Bob. Hence SIP traffic flows through RELOAD mechanisms directly from
Alice to BoB, right ? Furthermore security mechanisms from RELOAD are used
and no particular SIP-Header extension (i.e. signature) is needed ?

Cheers,
   Frédéric

---

From: Bruce Lowekamp <[email-masked]>
Date: Sun, 15 Mar 2009 13:09:21 -0400

RELOAD provides a rendezvous mechanism to use ICE to set up a direct
connection between Alice and Bob.  But after the initial setup, RELOAD
is out of the picture and the actual SIP traffic flows directly
between the two SIP UAs without any RELOAD involvement.

Bruce

On Sun, Mar 15, 2009 at 5:35 AM, Frédéric-Philippe Metz <[email-masked]> wrote:
> _______________________________________________
> P2PSIP mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/p2psip
>

---

From: Frédéric-Philippe Metz <[email-masked]>
Date: Sun, 15 Mar 2009 19:36:56 +0100

Hi,

Since the connection is established end-to-end then without RELOAD, how can
you rely on - as the receiver of i.e. INVITE - that the identity of the the
.. let's say "message elements" such as "From"-Header ... is really the
person providing this information ?

What I mean is: Then, is there any need of an SIP-header extension providing
the signature of the sending party ?

Cheers,
   Frederic

-----Original Message-----
From: Bruce Lowekamp [mailto:[email-masked]] 
Sent: Sonntag, 15. März 2009 18:09
To: Frédéric-Philippe Metz
Cc: [email-masked]
Subject: Re: [P2PSIP] Question: Security issue resp. RELOAD and SIP usage
draft-ietf-p2psip-sip-00

Bruce

---

From: "Wei Gengyu" <[email-masked]>
Date: Mon, 16 Mar 2009 09:06:54 +0800

Bruce,

If considering the P2PSIP overlay and RELOAD as signalling facilities,
some service or resource control are required during communications.

In this case, RELOAD might be needed after the initial setup.

Regards,

Gengyu

----- Original Message ----- 
From: "Bruce Lowekamp" <[email-masked]>
To: "Frédéric-Philippe Metz" <[email-masked]>
Cc: <[email-masked]>
Sent: Monday, March 16, 2009 1:09 AM
Subject: Re: [P2PSIP] Question: Security issue resp. RELOAD and SIP 
usagedraft-ietf-p2psip-sip-00

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 16 Mar 2009 09:31:51 -0700

At Sun, 15 Mar 2009 19:36:56 +0100,
> person providing this information ?

It's carried over a TLS connection, so you should have client auth.

-Ekr

---

From: Frédéric-Philippe Metz <[email-masked]>
Date: Mon, 16 Mar 2009 18:52:49 +0100

Hi,

Thanks. This implies that the peers then directly open a tcp connection and
SIP is transported over tls with that connection. 

UDP in that case can't be used, right ?

Within TLS, it may be neccessary to have a CA for certificates as an
enrollment server, right ?

Best Regards
Frédéric

-----Original Message-----
From: Eric Rescorla [mailto:[email-masked]] 
Sent: Montag, 16. März 2009 17:32
To: Frédéric-Philippe Metz
Cc: [email-masked]
Subject: Re: [P2PSIP] Question: Security issue resp. RELOAD and SIP usage
draft-ietf-p2psip-sip-00

-Ekr

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 16 Mar 2009 21:52:32 -0700

At Mon, 16 Mar 2009 18:52:49 +0100,
> UDP in that case can't be used, right ?

With DTLS.

> enrollment server, right ?

This is a general property of RELOAD.

-Ekr