Subject: RE: [Sip] RE: TLS meaning

From: "Elwell, John" <[email-masked]>
Date: Sun, 29 Oct 2006 11:24:40 +0000

Francois,

Taking into account also a ton of further messages on the subject since you
posted this, my opinion is as follows.

- I see some use in being able to determine that a request is hop-by-hop
secured.
- The last hop must not be excluded from this, although we might need to
allow the desired level of security to be achieved by some different means
in cases where sip-outbound can't be used (mobile UAs).
- For all hops, we must somehow specify what forms of security is
acceptable, e.g., by enumerating TLS/DTLS cipher suites.
- I would also find a best effort signalling security solution beneficial.
At present there is no mechanism to achieve this and find out whether you
got it or not, except by trying SIPS and if failing trying SIP - not very
efficient.

So whilst I go along with the principle of trying to fix SIPS in the sense
of having a well-specified hop-by-hop security mechanism, it does appear
that it will require quite a lot of work to fix it.

John

> -----Original Message-----
> From: Francois Audet [mailto:[email-masked]] 
> Sent: 27 October 2006 17:12
> To: IETF SIP List
> Subject: RE: [Sip] RE: TLS meaning
> 
> In case people having noticed, it is looking like we are having a
> mailing list 
> hum on the following 2 questions:
> 
> 1 - Do you favour deprecating the sips scheme altogether (yes/no)
> 
> 2 - Do you favour getting rid of the last-hop-exception rule (yes/no)
> 
> 
> Note: Voting Yes on 2 does not necessarily imply you are 
> voting No on 1,
> but it will
> only make sense if sips is not deprecated.
> 
> I'm keeping track of the vote.
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Cary FitzGerald <[email-masked]>
Date: Sun, 29 Oct 2006 10:54:34 -0800 (PST)

> in cases where sip-outbound can't be used (mobile UAs).

I've always thought that one of the interesting properties of SIP is that in general there is no way to know this is "the last hop."  Proxies forward methods to... something.  Could be a proxy, could be a UA.  If "last hop" means "into a trusted zone," then it logically follows that the signaling should have been secured outside of the trusted zone.  By definition the thing (UA or proxy) that handed the message to this "last hop" proxy is outside that zone.

> acceptable, e.g., by enumerating TLS/DTLS cipher suites.

And therefore, I agree with you.

> got it or not, except by trying SIPS and if failing trying SIP - not very

A UA/proxy is free to bid up security and use TLS even if it's not required.  As a UA I might do so on its first hop to the service provider.

Cary.