Subject: [SIP] draft-calhoun-sip-aaa-req

From: Michael Thomas <[email-masked]>
Date: Thu, 28 Dec 2000 10:26:38 -0800 (PST)

Has this document been discussed in either SIP or
the AAA working group? I've been trying to put
together a draft for requirements and maybe a way
to model the requirements for security for SIP.

This document seems to start with a model without
any definition of what the requirements are first
which seems completely backward to me. Indeed, it
seems to gather the requirements based on the
model. It also seems to make a huge number of
assumptions about the way that SIP will be
deployed which are rather service provider
centric. It's also not immediately apparent to me
how one implements these functions without
dragging in a gimongous and complicated AAA
infrastructure; IMO, moving AAA to a separate
server should be a last choice, not a first or
only choice.

		Mike

_______________________________________________
SIP mailing list
[email-masked]
http://lists.bell-labs.com/mailman/listinfo/sip

---

From: "Dean Willis" <[email-masked]>
Date: Thu, 28 Dec 2000 14:50:38 -0600

I have the impression that the authors started from the emerging 3G model
and the associated requirements and worked backward into AAA for SIP.

--
Dean

---

From: Matt Holdrege <[email-masked]>
Date: Thu, 28 Dec 2000 13:55:39 -0800

Some of the authors did indeed take 3G requirements into account. Other 
authors brought in requirements from other areas. Taking all the various 
requirements in and documenting them is the purpose of the draft. As I 
stated in the meeting (this should be in the minutes) we need to develop a 
document that describes the AAA requirements for networks that use SIP.

---

From: "Bernard D. Aboba" <[email-masked]>
Date: Fri, 29 Dec 2000 09:04:40 -0800 (GMT-0800)

The document has not been discussed in the AAA
WG, because AAA is focused on network access
requirements. 

Thus, it is completely up to the SIP WG to
define the security requirements for SIP,
which may or may not require AAA functionality
as a solution.

I'd note that for applications such as
telephony, where the client can often be
presumed to have Internet access, a wider
range of security solutions are available
than in network access, where by definition
the client does not have network access 
prior to authentication.

---

From: Henry Sinnreich <[email-masked]>
Date: Fri, 29 Dec 2000 11:30:14 -0600

>WG, because AAA is focused on network access

Thanks for the clarification! Have felt very uncomfortable with Diameter for
applications in the <always connected> case for various reasons, not at
least because of the AVP data format (prefer XML).
There may be good reasons to extend RADIUS to DIAMETER for legacy dial-up
service (the one we all want to move away from), but should be kept confined
there.

Henry

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Bernard D. Aboba
Sent: Friday, December 29, 2000 11:05 AM
To: Michael Thomas
Cc: SIP List
Subject: Re: [SIP] draft-calhoun-sip-aaa-req

---

From: Matt Holdrege <[email-masked]>
Date: Sun, 31 Dec 2000 10:53:22 -0800

>WG, because AAA is focused on network access

Not exactly. While the AAA charter formally states network access, 
always-on is mentioned in the AAA requirements document. Access means 
different things at different layers. People traditionally associate 
network access with a PPP session. We are addressing much more than that in 
the AAA WG. And requirements for SIP networks were added to the AAA WG.

>which may or may not require AAA functionality

It's up to the SIP WG to define their security requirements, but it's up to 
the users of SIP to choose an AAA solution. Some builders of SIP networks 
have chosen the IETF AAA WG DIAMETER protocol already.

>the client does not have network access

Access still happens on an always-on network. When your SIP phone calls my 
SIP phone that is a form of access. Same for when a SIP phone "accesses" a 
SIP proxy or network server. Now I'm not saying that DIAMETER belongs in 
SIP phones, definitely NOT! But DIAMETER can and will be used between SIP 
servers and back-end AAA systems.

As for the preference for XML, the AAA WG already has at least two 
proposals for an XML representation including candidate DTD's.