Subject: [Sip] Use of AIB in referredby

From: Robert Sparks <[email-masked]>
Date: 09 Jun 2003 15:00:07 -0500

Several weeks ago, Pekka made a suggestion that I would like to
follow up on now (sorry for the very long delay Pekka). His 
suggestion was to use a different Content-Disposition
disposition-type for referredby-tokens.

This draws attention to what the "aib" value means. 

Is it merely a synonym for "signed message/sipfrag"? If so, the
authid-body draft defines the value _and_ specifies one particular
use of a body with that disposition type (providing integrity and
authentication of sender for a single message). Other uses are valid,
so we should reuse it and not add noise to the IANA registry.

If, instead, "aib" means "signed message/sipfrag with these
particular security implications", then our referredby token
is _not_ an aib. It's something _like_ an aib, but with 
slightly different requirements, and artifacts in the protocol
(like the disposition-type) should probably reflect that. If this
is the case, referredby could register something like "RBIB"
(ReferredBy Identity Body), or, treading much more dangerous ground,
"TPIB" (Third Party Identity Body).

So, which of the above meanings for AIB is auth-id body establishing?

RjS

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Peterson, Jon" <[email-masked]>
Date: Fri, 13 Jun 2003 02:17:23 -0500

I look at the AIB as the application of sipfrags to the problem described in
RFC3261 23.4 - the tunneling of integrity and authentication properties
within the MIME bodies of SIP messages. In the AIB, these properties are
intended to provide identity, hence the name 'authenticated identity body'.
I think that the usage in referredby is sufficiently close to that purpose,
providing authenticated identity within a body, that I don't think we have a
problem with reuse of the term.

The real question, I think, is whether or not there is any value in
differentiating an AIB resulting from a REFER from any other AIB (such as a
'normal' one representing the sender of an INVITE) that might be in a
request. Surely these need to be differentiated somehow - the signature on
the AIB itself would be one indicator, as would the headers in the body, but
Content-Disposition is another point at which the two could be
distinguished. 

I don't have a strong intuition about whether or not the use of a different
Content-Disposition would be valuable.

Jon Peterson
NeuStar, Inc.

> -----Original Message-----
> From: Robert Sparks [mailto:[email-masked]]
> Sent: Monday, June 09, 2003 1:00 PM
> To: [email-masked]
> Cc: Jon Peterson
> Subject: Use of AIB in referredby
> 
>