Subject: Re: [Sip] TLS is not a "transport"

From: Rohan Mahy <[email-masked]>
Date: Wed, 30 Jan 2002 16:53:55 -0800

I have to agree with Mike here that ;transport=TLS will 
become ambigous when we have TLS over SCTP.

How about this ?

    tls+tcp    or    tls.tcp

this is legal in the current BNF and allows for

    tls+sctp   or    tls.sctp

at a later date.   i don't want to get into the ipsec.* 
debate now however.

thanks,
-rohan

---- Original message ----
>Date: Wed, 30 Jan 2002 09:33:56 -0800 (PST)
>From: Michael Thomas <[email-masked]>  
>Subject: Re: [Sip] TLS is not a "transport"  
>To: Jonathan Rosenberg <[email-masked]>
>Cc: Michael Thomas <[email-masked]>, [email-masked]
>
>Jonathan Rosenberg writes:
> > 
> > 
> > Michael Thomas wrote:
> > > 
> > > The bis-06 draft improperly conflates TLS with a
> > > transport protocol. This is incorret as it should
> > > be obvious if you want to use TLS over SCTP. Any
> > > conflation of this kind should be removed. HTTP
> > > got this wrong too. Better would be to have some
> > > sort of naming scheme which says: "SIP over
> > > transport protected by security protocol".
> > 
> > Are you arguing that instead of:
> > 
> > sip:user@domain;transport=tls
> > 
> > it should be:
> > 
> > sip:user@domain;transport=sip-over-tcp-protected-by-tls?
> > 
> > I think "tls" is better since its 3 bytes, compared to 
29. 
> > 
> > I suppose what you really mean is that the text needs to 
indicate that
> > TLS is not a transport, but we use the transport=tls 
parameter to
> > indicate that the UAC needs to use TCP protected by TLS. 
> > 
> > Or are you arguing something else?
>
>   I'm saying that your taxonomy is wrong. It should
>   be something of the form:
>
>   transport=tls.tcp or transport= tls.sctp
>
>   then you can also have things like:
>
>   transport=ipsec.tcp or transport=foo.udp
>
>   Even if you don't like the ipsec part, we already
>   need to consider tls over sctp. What's currently in
>   bis makes adding that pretty kludgey.
>
>		   Mike
>
>_______________________________________________
>Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
>This list is for NEW development of the core SIP Protocol
>Use [email-masked] for questions on 
current sip
>Use [email-masked] for new developments on the application 
of sip

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Christer Holmberg <[email-masked]>
Date: Thu, 31 Jan 2002 08:08:35 +0200

Hi,

I think we should decide the protocol level the transport parameter
should specify. Otherwise one could argue that the IP version should
also be there (tls.tcp.ip4, udp.ip6 etc etc).

Personally I don't think the SIP application should care about what is
under the transport protocol level, so I see no reason to include
"ipsec" in the transport parameter (tcp.ipsec etc).

For TLS, I agree with Rohan and Mike on tha fact that it should be
possible to differentiate between TLS/TCP and TLS/SCTP.

Just my thoughts...

Regards,

Christer Holmberg
Ericsson Finland

---

From: "Henning G. Schulzrinne" <[email-masked]>
Date: Thu, 31 Jan 2002 10:53:33 -0500

I agree that commingling a shim layer like TLS and TCP is not exactly
clean. In general, we're lacking a good term for these layers between
transport and application (such as RTP and TLS); they are not really
session or presentation layers, either.

There are roughly three choices:

(1) treat the label as just that; since the number of combinations is
small, it doesn't matter if we call SCTP + TLS "bob" or "42". No
application is magically going to go into its protocol toolbox and
dynamically pull up the loadable library based on names in the parameter
that it has never seen before.

(2) Have something descriptive, like tcp.tls;

(3) Label the shim layer separately, as in ;ts=tls (for transport
security).

(2) is the more readable version and 3 characters shorter than (3)...

-- 
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs

---

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 31 Jan 2002 14:05:36 -0500

> that it has never seen before.

This has been my assumption. We clarified that the token "tls" means TLS
over TCP. We can specify "tlsctp" as TLS/SCTP when its needed. Seems
thats about the range of things we'll need to further worry about for
some time. I'll also note that there are people using tls today, so
changing the name of this label would present a bit of a compatibility
issue. 

Let us not worry about non-problems.

-Jonathan R.
-- 
Jonathan D. Rosenberg, Ph.D.            72 Eagle Rock Avenue
Chief Scientist                         First Floor
dynamicsoft                             East Hanover, NJ 07936
[email-masked]                 FAX: (973) 952-5050
http://www.jdrosen.net                  PH:  (973) 952-5000
http://www.dynamicsoft.com