Subject: Re: [Sip] doubts about draft-gurbani-sip-domain-certs

From: "Vijay K. Gurbani" <[email-masked]>
Date: Mon, 02 Oct 2006 09:50:15 -0500

Catching up on pending email ... sorry for the delay.  More inline.

Tina TSOU wrote:
> [Tina4: In sip-sec-flow-01 section 8 Additional test scenarios, there
> is only DNS label being compared. But in this draft, URI label must
> be compared. This behavior is not compatible.]

The intent of domain-certs is to get enough traction so we
can normatively specify the behavior to be common across all
drafts.

> [Tina4: Perhaps I had missed some discussions on this draft about why
> SIP URI label should be introduced to TLS certificate verification and
> DNS label checking is not the preferred choice. Would you give me a
> reference?

Please see http://www3.ietf.org/proceedings/06jul/slides/sip-9.pdf,
and http://www3.ietf.org/proceedings/06jul/minutes/sip.html (search
for domain-certs).

> This is the question which missed in the text jungle in last mail. Is
> a host like multi-user computer within the scope of this draft? 

Yes.

> One  kind of attack in multi-user computer is being discussed in
> connect-reuse draft section 9.3. If all the users share the same site
> certificate, the same attack can happen for TLS. ]

Could you please amplify on how you see the attack proceeding...

Thanks,

- vijay
-- 
Vijay K. Gurbani  vkg@{lucent.com,research.bell-labs.com,acm.org}
Bell Laboratories, Lucent Technologies, Inc.
2701 Lucent Lane, Rm. 9F-546, Lisle, Illinois 60532 (USA)

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip