Subject: [Sip] TLS, IPSec and consensus (bug #232)

From: "Peterson, Jon" <[email-masked]>
Date: Wed, 30 Jan 2002 01:24:46 -0600

I would like to suggest, based on the list discussion that has transpired to
date, that the chairs consider whether or not we have rough consensus in
favor of the current normative text on TLS and IPSec in bis06 22.3.1.

The summary I sent out earlier today (along with Brian and Mike's summaries)
provides an account of the current state of the discussion. I believe that
the bis authors have been able to present a reasonable response to Mike's
strenuous objections. In any event, the issues are on the table, and those
who have debated these issues for months have essentially said their peace.
If there are any further arguments, or reflections on TLS vs. IPSec
transport vs. IPSec tunnel, from other members of the SIP community, let's
hear them now, by all means. Most respondents have indicated that they can
live with the text in bis06 today.

I would also note that to date the reception of the proposed minimal IPSec
profile (ESP transport mode HMAC-MD5-NULL) has been lukewarm, I think. Some
respondents have expressed a preference for tunnel mode IPSec. The IESG also
seems to feel that some encryption algorithm, as well as a story about
keying, should be a part of an IPSec profile for SIP. While some encryption
algorithms has been mentioned on the list (like DES, as required by RFC
2406), I haven't heard one that people sound entirely comfortable with.

Ultimately, we all agree that we need to arrive at an IPSec profile for SIP
- I just don't believe that we need to solve this problem in bis.

Jon Peterson
NeuStar, Inc. 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Michael Thomas <[email-masked]>
Date: Wed, 30 Jan 2002 09:42:38 -0800 (PST)

If you're going to gauge response to IPsec, you
need to do the same thing for TLS. I haven't seen
a whole lot of support for it either, and many
have raised objections to its obesity. 3G isn't
planning to use it on UA's; that does not bode
well. The fact is, looking for support for either
is not likely to get you very far. History has
shown that ostrich behavior here is the preferred
solution, even though that's not acceptable.

What I see right now is that we will not have an
interoperable standard for UA's. This is reality
-- small footprint UA's will take the STRONGLY
RECOMMENDED and ignore it in the blink of an
eye. The SMIME recommendation is similarly a
non-starter. The only thing that has *any*
possibility of being implemented uniformly is
digest and the minimal IPsec I've been talking
about. Things that require hundreds of kb of code
are going to flop on the very devices that need
protection the most.

	   Mike