Subject: RE: [Sip] TLS, IPSec and consensus (bug #232)

From: "Rosen, Brian" <[email-masked]>
Date: Wed, 30 Jan 2002 08:30:29 -0500

I dunno, I think I conclude that TLS and IPSec
are roughly equal good/bad depending on the
scenario you are advocating.  I'd like to see
a real IPSec profile defined in bis, and I think the
one Mike proposed is acceptable, although if
there is no objection to DES for confidentiality
that's okay with me.

I'd like to see a paragraph or two summarizing
when IPSec is more appropriate and when TLS is
more appropriate along the lines of Jonathan's
email. 

I'd like to see a distinction between what a UA
should/must do and what a PS should/must do.
I'd like the UA to not have to should/must
either TLS or IPsec, but rather be content
with Digest.  I'd like to see some words that
basically say that PS intended to work
within a domain must implement IPSec, and
PSs intended to work cross domain must implement
TLS and both should implement both.

Brian

> -----Original Message-----
> From: Peterson, Jon [mailto:[email-masked]]
> Sent: Wednesday, January 30, 2002 2:25 AM
> To: [email-masked]
> Subject: [Sip] TLS, IPSec and consensus (bug #232)
> 
> 
> 
> I would like to suggest, based on the list discussion that 
> has transpired to
> date, that the chairs consider whether or not we have rough 
> consensus in
> favor of the current normative text on TLS and IPSec in bis06 22.3.1.
> 
> The summary I sent out earlier today (along with Brian and 
> Mike's summaries)
> provides an account of the current state of the discussion. I 
> believe that
> the bis authors have been able to present a reasonable 
> response to Mike's
> strenuous objections. In any event, the issues are on the 
> table, and those
> who have debated these issues for months have essentially 
> said their peace.
> If there are any further arguments, or reflections on TLS vs. IPSec
> transport vs. IPSec tunnel, from other members of the SIP 
> community, let's
> hear them now, by all means. Most respondents have indicated 
> that they can
> live with the text in bis06 today.
> 
> I would also note that to date the reception of the proposed 
> minimal IPSec
> profile (ESP transport mode HMAC-MD5-NULL) has been lukewarm, 
> I think. Some
> respondents have expressed a preference for tunnel mode 
> IPSec. The IESG also
> seems to feel that some encryption algorithm, as well as a story about
> keying, should be a part of an IPSec profile for SIP. While 
> some encryption
> algorithms has been mentioned on the list (like DES, as 
> required by RFC
> 2406), I haven't heard one that people sound entirely 
> comfortable with.
> 
> Ultimately, we all agree that we need to arrive at an IPSec 
> profile for SIP
> - I just don't believe that we need to solve this problem in bis.
> 
> Jon Peterson
> NeuStar, Inc. 
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip
> 

This e-mail and any attachments are confidential. If you are not the
intended recipient, please notify us immediately by reply e-mail and then
delete this message from your system. Do not copy this e-mail or any
attachment, use the contents for any purposes, or disclose the contents to
any other person: to do so could be a breach of confidence.

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 30 Jan 2002 11:48:28 -0500

I agree with Brian on all points; as for the IPSec profile,
I'm for it if one can be defined in a reasonable time frame
and make the various security folks happy. If its going
to delay SIP one bit, we should not try to tackle it here.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.            72 Eagle Rock Avenue
Chief Scientist                         First Floor
dynamicsoft                             East Hanover, NJ 07936
[email-masked]                 FAX: (973) 952-5050
http://www.jdrosen.net                  PH:  (973) 952-5000
http://www.dynamicsoft.com