Subject: [Sip] RE: draft-audet-sip-sips-guidelines-00.txt: use of transport=tls

From: "Francois Audet" <[email-masked]>
Date: Mon, 17 Apr 2006 16:33:50 -0500

Yeah, let's make sure Cullen is reading this...

> > You would send the REGISTER using TLS in this case, but you 
> would be 
> > prepared to receive incoming requests on this connection 
> using either 
> > TLS or TCP.
> 
> So when using sip, the messages over the connection would not be 
> encrypted, but when using sips they would?
> 
> Can you do that with TLS? I'm no expert, but I thought once you 
> establish a connection, it starts out TCP but if you do the TLS 
> handshake then it is all TLS from then on.

I'm not sure either. Cullen?

The alternative I guess is for using an Outbound proxy, and then
re-using the existing TLS connection that is already there (created
by the REGISTER).

This would mean that when using Outbound and registering a sips 
contact, you'd always be using TLS on the last hop.

> *If* you can register these two contacts, one sip and one 
> sips, and they 
> can share the same connection, then I am *less* concerned. I still 
> suspect it will present complexities and problems.
> 
> Maybe Cullen will be able to comment on the impact to outbound.

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Jeroen van Bemmel" <[email-masked]>
Date: Tue, 18 Apr 2006 00:02:38 +0200

Francois,

Implementation wise you probably could use a single TCP connection for both 
encrypted and unencrypted data ( i.e. SSL records and regular data, much 
like you can do SIP and STUN over the same TCP connection). I doubt you'll 
find any SSL implementations that support this currently, main reason is 
probably that you SHOULD NOT want such a thing ...

You can have a NULL cipher, but you'd still get SSL records on the TCP line. 
In other words, this would not be equivalent with what you currently get 
using the "sip:" scheme

This triggered me though - is there any guidance on the mapping of a SIP 
message to SSL records? a one-to-one mapping seems beneficial for detection 
of message boundaries, but this would work only if it were standardized.

Regards,

Jeroen

----- Original Message ----- 
From: "Francois Audet" <[email-masked]>
To: "Paul Kyzivat" <[email-masked]>; "Cullen Jennings" 
<[email-masked]>
Cc: "SIP IETF" <[email-masked]>
Sent: Monday, April 17, 2006 11:33 PM
Subject: [Sip] RE: draft-audet-sip-sips-guidelines-00.txt: use 
oftransport=tls