Subject: [Sip] SIP and PKI

From: Michael Thomas <[email-masked]>
Date: Mon, 28 Jan 2002 13:02:01 -0800 (PST)

bis-06 implies very strongly that SIP elements
should use PKI based authentication. This should
be removed. There are other means of
authentication -- even within IETF -- and SIP
shouldn't be picking winners, especially when
there is absolutely no evidence that one is
superior to the other in the field. Indeed, the
evidence is that PKI's are *not* popular.

	    Mike

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 30 Jan 2002 11:58:42 -0500

Michael Thomas wrote:
> be removed.

Hmm, I don't recall it saying you had to use PKI, just
that S/MIME is a SHOULD. Honestly, I think its useless
for encryption, but there is a VERY useful application
for authentication using self-signed certs. That doesn't
require a PKI, since you can self-generate keys. It seems
to me, although I am admittedly an amateur at security 
protocols compared to many others on this list, that
this gives us the only easily definable protection against
the set of call hijacking attacks, where an passive attacker
monitors my call, and injects faked BYE/INVITE with the proper
dialog IDs. Assuming that, practically speaking, there is not
ever going to be shared secrets between users, or a PKI, this 
is a pretty workable solution that does a lot of good with 
low cost, in terms of specification and availability of code
to accomplish it.

I wonder what other mechanisms you know of that are already defined,
proven, and are easily integrated into SIP, and which work through
SIP's multi-hop environment? Don't get me wrong, I'd love to see
a ligher-weight approach to this, but I didn't see any off-the-shelfs
for this. 

-Jonathan R.
-- 
Jonathan D. Rosenberg, Ph.D.            72 Eagle Rock Avenue
Chief Scientist                         First Floor
dynamicsoft                             East Hanover, NJ 07936
[email-masked]                 FAX: (973) 952-5050
http://www.jdrosen.net                  PH:  (973) 952-5000
http://www.dynamicsoft.com