Subject: RE: What controls the lock icon? (Was RE: [Sip] RE: TLS meaning)

From: "Elwell, John" <[email-masked]>
Date: Tue, 31 Oct 2006 09:06:25 +0000

I agree with Hadriel. There might be a need for some additional signalling
element to indicate that we have reached PSTN, rather than a true endpoint,
but as far as SIP is concerned if we have TLS all the way to the UAS, then
that satisfies SIPS.

John

> -----Original Message-----
> From: Hadriel Kaplan [mailto:[email-masked]] 
> Sent: 31 October 2006 02:36
> To: 'Brian Rosen'; Elwell, John; 'IETF SIP List'
> Subject: RE: What controls the lock icon? (Was RE: [Sip] RE: 
> TLS meaning)
> 
> I'm not sure that's tenable.  When the request reaches the 
> PSTN gateway, it
> reached the UAS.  It would be practically impossible to 
> define otherwise.
> What would an IAD/MTA do, if it received a SIPS request but 
> would be ringing
> a POTS/FXS interface in the house?  What if that IAD were 
> physically in the
> CO?  What would a PBX do, key-system, etc.  Or even if it 
> stayed IP - what
> would a SIP-to-Skype inter-working gateway do, or an 
> enterprise system that
> controlled phones with skinny/unistim/whatever.  What would 
> it mean if the
> UAS used H.248 or MGCP to control media gateways while sending the
> "signaling" securely using sigtrans over TLS?
> 
> SIPS asked for SIP over TLS.  When it reached the SIPS UAS, it got it.
> 
> -hadriel
> 
> 
> > -----Original Message-----
> > From: Brian Rosen [mailto:[email-masked]]
> > Sent: Monday, October 30, 2006 1:23 PM
> > 
> > I think in order to be useful:
> > sips: means yes you must carry TLS through B2BUAs and 
> anything else that
> > could create an unsecure link
> > sips: means fail if you terminate on a gateway that 
> interworks to a non
> > TLS
> > supported protocol, and the gateway must carry TLS through 
> a protocol that
> > supports TLS.
> > 
> > Nothing else makes sense to me.
> > 
> > For B2BUAs and SBCs and other things, I think there is a 
> simple test: if
> > the
> > ciphersuite included encryption, is the signaling encrypted 
> end to end?
> > 
> > For gateways, I think talking about interworking to non TLS secured
> > protocols is not what I want the sips success to mean.  
> It's not a secure
> > TLS hop by hop end to end.  This is especially true if the 
> gateway is to
> > the
> > PSTN.  It does mean that a gateway that interworked to, say 
> H.323 could
> > succeed with sips if it was possible to determine that the 
> H.323 signaling
> > was TLS protected all the way.
> > 
> > Brian
> > 
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Elwell, John" <[email-masked]>
Date: Tue, 31 Oct 2006 09:43:33 +0000

> From: [email-masked] [mailto:[email-masked]] 
> Sent: 31 October 2006 09:30
> To: Elwell, John
> Cc: Joel M. Halpern; 'IETF SIP List'
> Elwell, John writes:
>  > TLS is not available. So a SIPS request would get 
> rejected. Now this is fine
>  > if the caller is interested in making the call only if it 
> can be a secure
>  > call (whatever that means), but in many cases the caller 
> would want to
>  > accept an insecure call and the UAC would have to try again with
>  > SIP. 
> 
> i don't think that signaling security alone without media 
> security means
> anything to common users.
[JRE] Quite so. I was just making the (rather unsound) assumption that SIPS
is a necessary aspect of achieving a secure call, including media security.
As I said in other messages, I am far from convinced that SIPS is part of
this story.

> this is further justification of dropping
> sips.
> 
>  > So in
>  > this case, just doing best effort and notifying the UAC 
> (and perhaps also
>  > the UAS) would be sufficient. The point is, how often does 
> a UAC require TLS
>  > or nothing, as opposed to best effort TLS? And how often 
> do proxies route
>  > SIP requests over TCP or UDP even though TLS would be 
> available to SIPS
>  > requests?
> 
> it would make sense to always use tls out as long as the next hop
> supports it.  there is no need for sips to tell that to the proxy.
[JRE] Thanks, that is what I suspected.

> -- juha

---

From: "Michael Hammer \(mhammer\)" <[email-masked]>
Date: Tue, 31 Oct 2006 10:54:43 -0500

BTW, I don't have a problem with some of the behaviors described, just
stop the false advertizing aspect.

Also, it would be clearer if there is a distinction between using a sips
address and having "sips-like" signaling behavior.  I don't always know
when someone says "SIPS" if it is mean euphemistically.

You could have sips-like behavior, but not use sips:URI.

Mike

> From: Francois Audet [mailto:[email-masked]] 
> Sent: Monday, October 30, 2006 3:03 PM
> To: Paul Kyzivat (pkyzivat); Elwell, John
> Cc: IETF SIP List
> I really don't understand why people keep on bringing the 
> padlock thing again in the context of sips.
>