Subject: RE: [Sip] A sips: trial balloon for you to shoot down

From: "Sanjay Sinha \(sanjsinh\)" <[email-masked]>
Date: Tue, 31 Oct 2006 14:00:51 -0500

Don't like the PSTN gateway limitation. As was mentioned in an earlier
email, if signaling reaches PSTN gateway, it has reached UAS.

Sanjay

>-----Original Message-----
>From: Dean Willis [mailto:[email-masked]] 
>Sent: Tuesday, October 31, 2006 1:21 PM
>To: IETF SIP List
>Subject: [Sip] A sips: trial balloon for you to shoot down
>
>
>Ok, let me make a proposal, or perhaps remake one somebody 
>else has made. I've lost track of who said what...
>
>I think we're now talking about a BCP for secure operations.
>
>1) Implementations of SIP SHOULD use TLS as described in RFC 
>3261 for all SIP traffic, including traffic using a sip: URI 
>scheme. Failure to use TLS may result in disclosure of 
>sensitive signaling information to third parties. As a matter 
>of local policy, some deployments MAY use IPSEC or physically 
>protected infrastructure instead of TLS on specific links. 
>Examples where this might be appropriate include persistent 
>IPSEC relationships between proxies within an operational 
>domain and physically protected "private network" cables 
>between a TLS concentrator and the device it is fronting for. 
>Where TLS is not used, the implementor MUST exercise a high 
>level of caution to provide adequate security and MUST 
>preserve operationally equivalent protection of message 
>integrity, privacy, and participant identity (authentication).
>
>2) When using the sips: URI scheme, implementations MUST NOT 
>exercise the "last hop exception" for sips: processing 
>described in RFC 3261.  
>Most scenarios where this technique might have seemed 
>appropriate can be better satisfied using a client-initiated 
>TLS connection as described in draft-ietf-sip-outbound. User 
>agents that do not implement both TLS and either terminate TLS 
>connections or exercise draft-ietf-sip-outbound with a 
>US-originated TOS connection to an outbound will therefore not 
>be able to exercise the sips: URI scheme.  
>Failure to observe this requirement is likely to result in a 
>reduction of operational security below that expected from the sips:  
>URI scheme.
>
>3) Since some user-agents will not be able to exercise the sips:  
>scheme, implementations MUST anticipate the failure of sips: 
>requests and in general SHOULD use sips: only when it is 
>desired that the request will not complete unless TLS will be 
>used on each hop. Since requests using the sip: URI scheme are 
>(by requirement 1 above) expected to be as securely processed 
>as the implementation is able to do, it is not suggested that 
>one first try sips: and then back off to sip:. In other words, 
>if you're willing to settle for the best security that can 
>actually be provided, simply originate the request with a sip: 
>URI scheme.
>
>4) User agent servers that terminate a request using the sips: 
>URI scheme MUST create any dependent requests using the sips: 
>URI scheme.  
>This preserves the commitments of the sips: scheme, and 
>failure to observe this constraint would give the appearance 
>of sips: security where no such security exists. For example, 
>this requirement means that that back-to-back user agents 
>bridging two sips: requests use
>sips: on both sides. Furthermore, gateways to other protocols 
>not offering equally strong protections MUST NOT exercise the 
>sips: URI scheme. In particular, PSTN gateways MUST NOT use 
>sips:, since the PSTN itself does not offer equivalent 
>protections and there is no ability to determine whether the 
>PSTN segment might be converted back to a sip: request 
>somewhere downstream.
>
>
>--
>Dean
>
>
>_______________________________________________
>Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
>This list is for NEW development of the core SIP Protocol Use 
>[email-masked] for questions on current sip 
>Use [email-masked] for new developments on the application of sip
>

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Dean Willis <[email-masked]>
Date: Tue, 31 Oct 2006 14:34:15 -0600

> email, if signaling reaches PSTN gateway, it has reached UAS.

But what's the diff between (PSTN gateway, a hunk of PSTN, another  
PSTN gateway) and an SBC? Both provide the same downgrade attack if  
we don't have this requirement.

--
Dean