Subject: [Sip] SIP SAML: Issue #5 - Replay Protection: SIP specific Fields in the SAML Assertion

From: Hannes Tschofenig <[email-masked]>
Date: Sun, 15 Oct 2006 15:52:34 +0200

Hi all,

Jonathan sent us comments regarding replay protection for SIP SAML. We 
captured the feedback at:
http://www.tschofenig.priv.at:8080/saml-sip/issue5

I agree with Jonathan's observation. We should define some new fields 
that can be carried in the SAML assertion and address this threat.

Objections?

Ciao
Hannes

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jeff Hodges <[email-masked]>
Date: Tue, 24 Oct 2006 01:26:21 -0700

> that can be carried in the SAML assertion and address this threat.

agreed.

We need to be careful about how retargeting and forking might affect what sort 
of info we include in the SAML Assertion, yes?

=JeffH

wable,
as long as the resource resolves one way or another into a "..certificate of
the authentication service" (1st sentence above) -- as in a URI pointing to a
SAML assertion containing such a cert.

thoughts?

thanks,

=JeffH

---

From: Jeff Hodges <[email-masked]>
Date: Tue, 24 Oct 2006 01:26:21 -0700

agreed.

=JeffH

---

From: "Tschofenig, Hannes" <[email-masked]>
Date: Tue, 24 Oct 2006 11:20:00 +0200

Hi Jeff, 

that's a good point. In issue#3 Jonathan complainted about the restrictions we put into the conditions element (see http://www.tschofenig.priv.at:8080/saml-sip/issue6) and he points to the problems in context with retargeting and forking. 

In issue#5 (see http://www.tschofenig.priv.at:8080/saml-sip/issue5), however, Jonathan wants to put some additional fields into the SAML assertion to prevent replay attacks. 

I think we can only put parameters like From, Contact, Date and Call-ID in there to avoid jumping into other problems. With the generalized approach used in SIP Payment there are more options, such as using the holder-of-the-key assertion.

Ciao
Hannes

> -----Ursprüngliche Nachricht-----
> Von: Jeff Hodges [mailto:[email-masked]] 
> Gesendet: Dienstag, 24. Oktober 2006 10:26
> An: IETF SIP List
> Betreff: Re: [Sip] SIP SAML: Issue #5 - Replay Protection: 
> SIP specific Fieldsin the SAML Assertion
> 
> Hannes Tschofenig wrote:
>  >