Subject: RE: [Sip] TLS vs IPsec

From: "Peterson, Jon" <[email-masked]>
Date: Tue, 29 Jan 2002 22:32:51 -0600

This is really very useful; there are certainly multiple architectures that
motivate our security positions. The focus on interoperability between
TLS-based and IPSec-based services is also interesting - I don't think we've
yet plumbed that space for requirements. That might warrant an I-D in and of
itself down the road. ;)

I agree that the SIP community needs to settle on a minimal IPSec profile.
As we saw during the email thread yesterday, however, this might be more
complicated than we initially surmised. I would suggest that this IPSec
profile be explored in a separate I-D, possibly in the context of the SIP
security design team. Your note seems to have a good start on a profile.

I do have one additional comment below.

Jon Peterson
NeuStar, Inc.

> -----Original Message-----
> From: Rohan Mahy [mailto:[email-masked]]
> Sent: Tuesday, January 29, 2002 5:50 PM
> To: [email-masked]
> Subject: [Sip] TLS vs IPsec
> 
[snip]
> 
> SIP User Agents which are designed for general purpose use on the
> Internet at large SHOULD use TLS.  SIP User Agents designed for use in
> private networks MAY use either TLS or IPsec.  SIP Proxy 
> Servers used in
> private networks MUST support TLS *and* whatever the User Agents use.
> 

Implementers may not know how a device they build will be used. I think
that, unfortunately, vendors are on the hook to implement more things than
any individual service provider is likely to deploy. The prerogative of the
IETF, I think, is mostly to suggest what one must implement.

[snip]
> thanks,
> -rohan

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip