Subject: RE: [Sip] TLS, IPSec and consensus (bug #232)

From: "Sanjoy Sen"<[email-masked]>
Date: Wed, 30 Jan 2002 16:39:08 -0600

> -----Original Message-----
> From: Peterson, Jon [mailto:[email-masked]]
> Sent: Wednesday, January 30, 2002 1:05 PM
> To: 'Rosen, Brian'; Peterson, Jon; [email-masked]
> Subject: RE: [Sip] TLS, IPSec and consensus (bug #232)
> 
> 
> Brian is right about the fact that both IPSec and TLS work 
> only for the
> respective architectures to which they are applicable. I 
> agree that there is
> a critical need for an IPSec profile - I think the only real 
> question is
> whether or not it needs to be in bis in order for the 
> security story in bis
> to be complete. I don't know of any litmus test for this. I 
> do know that I
> got the impression that punting on confidentiality and keying 
> wouldn't be
> acceptable. 

[SS] I agree. As you know, there has been some work going on adjunct to the
SIP Security Design to enhance Digest to enable UA's authenticate Proxies
(in particular, last hop Proxies), provide complete message integrity
protection over last/first hop and prevent bid-down attacks. Without
encryption & keying (those Digest can't address), the minimum IPSec profile
won't be very useful. 

Sanjoy

---

From: Michael Thomas <[email-masked]>
Date: Thu, 31 Jan 2002 11:34:53 -0800 (PST)

> encryption & keying (those Digest can't address), the minimum IPSec profile

   Again, this is a *minimum* requirement. IPsec has
   the ability to do these things in a completely
   standard and interoperability-proven way. Digest
   does not. Any UA is completely at liberty to go
   beyond minimum requirements. In fact, it is to
   be encouraged.

		  Mike

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip