Subject: End-to-end security (was RE: [Sip] Re: Wacky thead...

From: [email-masked]
Date: Wed, 31 May 2006 14:38:50 -0500

Thinking a bit more about this end-to-end thing, I thought I would float an idea that has probably been proposed before...

First, it seems like the interposition of proxies as a basic architectural element is a non-starter.  What I mean is, if there are proxies in there somewhere, you can probably make an argument that the proxy could be compromised.  If the signaling has to pass through the proxy, you cannot guarantee end-to-end security.

If you grant that, then an INVITE must go from the UAC to the UAS directly.  The question is, how do you make that happen?  How do you guarantee to the caller that the INVITE is not traversing any proxies along the way?

I'm wondering if there can't be some kind of end-to-end mode for signaling?  Let's say that a UAC wants to make an end-to-end secure call to an UAS.  Perhaps the UAC could query a presence service for the actual endpoint address of the UAS.  Perhaps we could add some presence bits that tell the presence server that a UAS is at this address for direct access and then when the UAC queries for the UAS, it gets that address.

If this were done, the trust would be changed to trusting the UAS and the presence server.  Is that better than trusting the proxies during hop-by-hop signaling?

FM

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Dale R. Worley" <[email-masked]>
Date: Wed, 31 May 2006 15:54:20 -0400

It's nearly pointless to try to keep signaling confidential.  The
packets have to go from the UAC to the UAS, and anybody who cuts into
the wire can watch that.  There is some advantage to avoiding forwarding
the INVITE through proxies, as the proxies become targets for
*concentrated* attack.  But that's not much.

Conversely, if you eliminate the proxies, the UAC must know the IP
address of the UAS de novo.  (If it knew only the DNS name, the DNS
server would be a point of attack.)

The best you can do is about what current security proposals allow -- a
not particularly secure means for putting the UAC and UAS into contact.
After that, they can validate their identities to each other securely,
and exchange media securely.

Dale

---

From: "Dolly, Martin C, ALABS" <[email-masked]>
Date: Wed, 31 May 2006 15:13:07 -0500

The hop-by-hop method needs to be supported, not just with proxies but
B2BUAs. 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Wednesday, May 31, 2006 3:39 PM
To: Dean Willis; [email-masked]
Cc: Sip; Paul Kyzivat
Subject: End-to-end security (was RE: [Sip] Re: Wacky thead...

Thinking a bit more about this end-to-end thing, I thought I would float
an idea that has probably been proposed before...

First, it seems like the interposition of proxies as a basic
architectural element is a non-starter.  What I mean is, if there are
proxies in there somewhere, you can probably make an argument that the
proxy could be compromised.  If the signaling has to pass through the
proxy, you cannot guarantee end-to-end security.

If you grant that, then an INVITE must go from the UAC to the UAS
directly.  The question is, how do you make that happen?  How do you
guarantee to the caller that the INVITE is not traversing any proxies
along the way?

I'm wondering if there can't be some kind of end-to-end mode for
signaling?  Let's say that a UAC wants to make an end-to-end secure call
to an UAS.  Perhaps the UAC could query a presence service for the
actual endpoint address of the UAS.  Perhaps we could add some presence
bits that tell the presence server that a UAS is at this address for
direct access and then when the UAC queries for the UAS, it gets that
address.

If this were done, the trust would be changed to trusting the UAS and
the presence server.  Is that better than trusting the proxies during
hop-by-hop signaling?

FM