Subject: [Sip] Minor comments on "draft-ietf-sip-identity-05"

From: "Tao Wan" <[email-masked]>
Date: Wed, 11 May 2005 17:36:27 -0400

> I quickly went through the nice draft titled "Enhancements for
> Authenticated Identity Management in the Session Initiation Protocol
> (SIP)" dated March ? 2005 (expires September 2, 2005). Here are some minor
> editorial comments and questions which may or may not have been addressed.
> 
> 
> Thanks,
> 
> Tao Wan
> 
> page 4, para 2, line 4: "if you are can prove ..." ==> "If you can prove"
> page 6, para 5, line 1: "as the holder the private key" ==> "as the holder
> of the private key"
> page 13, last para, second last line: "The result in placed int the
> Identity ..." ==> "The result is placed in the identity ..."
> page 14, para 1, line 1: "Note on the use of 'rsa-sha1' ..." ==> "Note on
> the use of 'rsa-sha1' with 1024-bit RSA signing key..." ???
> page 17, para 1, line 1: "in authenticates Alice ..." ==> "it
> authenticates Alice"
> page 18, para 1, line 3: "the URL the Identitiy-Info..." ==> "the URL
> carried in the Identity-Info..."
> page 23, para 1, line 9: "This result of this is..." ==> "The result of
> this is..."
> page 24, para 3, line 5: "men-in-the-middle is ..." ==> "man-in-the-middle
> is ..." (unless you mean there are more than one man in the middle :)
> 
> Section 4 (Requirements)
> 
> bullet 2: What exactly does network lookup mean here?  Dereference of an
> Identity-Info may involve DNS lookups. Is that considered as   network
> lookup? If yes, this requirement is actually not met. 
> 
> bullet 3: "User agents that hold certificates on behalf of their user
> ...". Do you mean "User agents that hold private keys on behalf of their
> user  .."? There are several places where a certificate may mean a private
> key, e.g.,
> page 13, last para, line 1-2: "it MUST be hashed and signed with the
> certificate for the domain".
> 
> Section 10 (Header Syntax)
> 
> page 14, para 2, line 2: "either an HTTP or HTTPS URI which ...". 
> Since a public key certificate is self integrity protected and does not
> need confidentiality, is there any reason (other than flexibility) why
> HTTPS will be needed? Since all examples given in section 11 use https, it
> makes me wonder there may be some reason I am not aware of.
_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Peterson, Jon" <[email-masked]>
Date: Wed, 11 May 2005 19:09:09 -0400

Thanks for your reading of this document. The nits you've caught are certainly very welcome.
 
Regarding the requirement concerning network lookups, it is true of course that dereferencing the Identity-Info may entail a DNS lookup, or it may not, if the verifier already holds the corresponding certificate. The intent behind this requirement was to express something more along the lines that a 'dialback' verificiation system was not a requirement (where the verifier sends some SIP-layer message in the backwards direction to which the caller would respond). Probably should be clarified.
 
User agents that hold certificates on behalf of their users refers to user agents that instantiate the authentication service role, and thus hold a private/public key pair associated with a certificate.
 
Regarding the use of HTTPS, it is included just for flexibility - you are correct that since the certificate is self-verifying, there is no intrinsic need for HTTPS security properties when fetching a cert.
 
Jon Peterson
NeuStar, Inc.

-----Original Message-----
From: Tao Wan [mailto:[email-masked]]
Sent: Wednesday, May 11, 2005 2:15 PM
To: Peterson, Jon; [email-masked]'
Cc: [email-masked]'
Subject: Minor comments on "draft-ietf-sip-identity-05"

I quickly went through the nice draft titled "Enhancements for Authenticated Identity Management in the Session Initiation Protocol (SIP)" dated March ? 2005 (expires September 2, 2005). Here are some minor editorial comments and questions which may or may not have been addressed. 

Thanks, 

Tao Wan 

page 4, para 2, line 4: "if you are can prove ..." ==> "If you can prove" 
page 6, para 5, line 1: "as the holder the private key" ==> "as the holder of the private key" 
page 13, last para, second last line: "The result in placed int the Identity ..." ==> "The result is placed in the identity ..."

page 14, para 1, line 1: "Note on the use of 'rsa-sha1' ..." ==> "Note on the use of 'rsa-sha1' with 1024-bit RSA signing key..." ???

page 17, para 1, line 1: "in authenticates Alice ..." ==> "it authenticates Alice" 
page 18, para 1, line 3: "the URL the Identitiy-Info..." ==> "the URL carried in the Identity-Info..." 
page 23, para 1, line 9: "This result of this is..." ==> "The result of this is..." 
page 24, para 3, line 5: "men-in-the-middle is ..." ==> "man-in-the-middle is ..." (unless you mean there are more than one man in the middle :)

Section 4 (Requirements) 

bullet 2: What exactly does network lookup mean here?  Dereference of an Identity-Info may involve DNS lookups. Is that considered as   network lookup? If yes, this requirement is actually not met. 

bullet 3: "User agents that hold certificates on behalf of their user ...". Do you mean "User agents that hold private keys on behalf of their user  .."? There are several places where a certificate may mean a private key, e.g.,

page 13, last para, line 1-2: "it MUST be hashed and signed with the certificate for the domain". 

page 14, para 2, line 2: "either an HTTP or HTTPS URI which ...". 
Since a public key certificate is self integrity protected and does not need confidentiality, is there any reason (other than flexibility) why  HTTPS will be needed? Since all examples given in section 11 use https, it makes me wonder there may be some reason I am not aware of.