Subject: RE: [Sip] TLS is not a "transport"

From: "Peterson, Jon" <[email-masked]>
Date: Wed, 30 Jan 2002 16:25:10 -0600

I'm not sure how a SIP application would know whether or not SIP is running
over IPSec in some architectures. Especially problematic under your proposal
are cases in which a SIP application sends a Via header in a request
indicating that the current transport is UDP/IPSec, but this message passes
through a security gateway, and by the time it reaches the next hop it has
in fact become over UDP/IP (and this seems to be one of several related
cases). I'm also not sure what we would get out of this (then again, nor am
I entirely sure we get out of having transport=tls rather than just
transport=tcp - but that's a whole different kettle of fish).

Jon Peterson
NeuStar, Inc.

> -----Original Message-----
> From: Michael Thomas [mailto:[email-masked]]
> Sent: Wednesday, January 30, 2002 9:34 AM
> To: Jonathan Rosenberg
> Cc: Michael Thomas; [email-masked]
> Subject: Re: [Sip] TLS is not a "transport"
> 
> 
> Jonathan Rosenberg writes:
>  > 
>  > 
>  > Michael Thomas wrote:
>  > > 
>  > > The bis-06 draft improperly conflates TLS with a
>  > > transport protocol. This is incorret as it should
>  > > be obvious if you want to use TLS over SCTP. Any
>  > > conflation of this kind should be removed. HTTP
>  > > got this wrong too. Better would be to have some
>  > > sort of naming scheme which says: "SIP over
>  > > transport protected by security protocol".
>  > 
>  > Are you arguing that instead of:
>  > 
>  > sip:user@domain;transport=tls
>  > 
>  > it should be:
>  > 
>  > sip:user@domain;transport=sip-over-tcp-protected-by-tls?
>  > 
>  > I think "tls" is better since its 3 bytes, compared to 29. 
>  > 
>  > I suppose what you really mean is that the text needs to 
> indicate that
>  > TLS is not a transport, but we use the transport=tls parameter to
>  > indicate that the UAC needs to use TCP protected by TLS. 
>  > 
>  > Or are you arguing something else?
> 
>    I'm saying that your taxonomy is wrong. It should
>    be something of the form:
> 
>    transport=tls.tcp or transport= tls.sctp
> 
>    then you can also have things like:
> 
>    transport=ipsec.tcp or transport=foo.udp
> 
>    Even if you don't like the ipsec part, we already
>    need to consider tls over sctp. What's currently in
>    bis makes adding that pretty kludgey.
> 
> 		   Mike
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Michael Thomas <[email-masked]>
Date: Wed, 30 Jan 2002 16:03:35 -0800 (PST)

> transport=tcp - but that's a whole different kettle of fish).

   I don't understand half of this, but it's hardly
   important. The current mechansim doesn't provide
   a means to specify SCTP over TLS. What now?

	   Mike