Subject: Re: What consensus? (was: What controls the lock icon? (Was RE: [Sip] RE: TLS meaning))

From: Avshalom Houri <[email-masked]>
Date: Wed, 1 Nov 2006 13:55:09 +0200

Seems that we need a mechanism to create a trusted "channel" between
endpoints that goes through all the intermediaries. The channel should
verifiable as secure between the endpoints. After the channel is created
then the SIP signalling can go securely over the channel.

The protocol for creating such a channel may be SIP based on
external to SIP and after we have such a mechanism we can decide if we
will use SIPS for messages that need to go over the secure channel
or we will use new URI type (e.g. SSIP) or just use some
header in the SIP message.

The other alternative is the usage of S/MIME which has its drawbacks as
we can see in another thread.

Other then a secure channel or S/MIME I do not think that it will be
possible to send a SIP message and get real assurance that the message
will be sent securely in every hop.

--Avshalom

Dean Willis <[email-masked]> 
31/10/2006 18:51

To
Michael Thomas <[email-masked]>
cc
"Joel M. Halpern" <[email-masked]>, "'IETF SIP List'" 
<[email-masked]>, Juha Heinanen <[email-masked]>, "Elwell, John" 
<[email-masked]>
Subject
Re: What consensus? (was: What controls the lock icon? (Was RE: [Sip] RE: 
TLS meaning))

On Oct 31, 2006, at 8:47 AM, Michael Thomas wrote:

> My advise to the working group is to just start over from first 
> principles as if
> SIPS didn't even exist -- which in reality it doesn't. We need to 
> be thinking
> about these things for the long term, and if it's not baked it's 
> not baked. There
> have been many drafts that have lingered on and completely 
> overhauled over
> the years. Why SIPS is treated so differently in that respect is 
> somewhat
> mystifying because dealing with security for SIP is a genuinely 
> hard problem.
> It shouldn't be rushed, and it deserves better than a kludgey 
> security patina
> airbrushed in to get past the IESG.

I'm very tempted to endorse this, but I think you're missing one thing.

Flimsy as it is, I believe that sips: is as strong as the rest of the 
current SIP security model since it depends on the same trust 
assumptions.

We can't just restart on sips: without restarting from those 
fundamental trust assumptions.

This is not trivial. Many people would argue that it would turn SIP 
into a fundamentally different protocol. I think it needs to be done, 
but I also think we need to clearly document how the current trust 
model (including sips:) works, because that's what's going to be 
deployed in the real world for a relatively long time.

The P2PSIP work is having to re-examine those fundamental trust 
assumptions. My current hope is we can do some work there that can be 
"ported back" into SIP.

--
Dean

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Henry Sinnreich" <[email-masked]>
Date: Wed, 1 Nov 2006 05:52:26 -0800

>will be sent securely in every hop.

As you correctly conclude, P2P SIP has the opportunity to finally make
SIP secure.

Thanks, Henry

________________________________

From: Avshalom Houri [mailto:[email-masked]] 
Sent: Wednesday, November 01, 2006 5:55 AM
To: [email-masked]
Subject: Re: What consensus? (was: What controls the lock icon? (Was
RE:[Sip] RE: TLS meaning))

--Avshalom 

31/10/2006 18:51 

To

cc

Subject

Re: What consensus? (was: What controls the lock icon? (Was RE: [Sip]
RE: TLS meaning))

--
Dean

---

From: "Hadriel Kaplan" <[email-masked]>
Date: Wed, 1 Nov 2006 10:01:58 -0500

I think what you're talking about is SIPSEC, the draft Dean mentioned
earlier.
Good luck with that.  ;)
-hadriel

------------------------------------------------------
From: Avshalom Houri [mailto:[email-masked]] 
Sent: Wednesday, November 01, 2006 6:55 AM
To: [email-masked]
Subject: Re: What consensus? (was: What controls the lock icon? (Was
RE:[Sip] RE: TLS meaning))

--Avshalom

---

From: "Francois Audet" <[email-masked]>
Date: Wed, 1 Nov 2006 11:13:04 -0600

Or at least to move to a different set of security problems. :^)

	From: Henry Sinnreich [mailto:[email-masked]] 
	Sent: Wednesday, November 01, 2006 5:52 AM
	To: Avshalom Houri; [email-masked]
	Cc: [email-masked]
	Subject: RE: What consensus? (was: What controls the lock icon?
(Was RE:[Sip] RE: TLS meaning))

	>will be sent securely in every hop.

	As you correctly conclude, P2P SIP has the opportunity to
finally make SIP secure.

	Thanks, Henry

	From: Avshalom Houri [mailto:[email-masked]] 
	Sent: Wednesday, November 01, 2006 5:55 AM
	To: [email-masked]
	Subject: Re: What consensus? (was: What controls the lock icon?
(Was RE:[Sip] RE: TLS meaning))

	Seems that we need a mechanism to create a trusted "channel"
between 
	endpoints that goes through all the intermediaries. The channel
should 
	verifiable as secure between the endpoints. After the channel is
created 
	then the SIP signalling can go securely over the channel. 
	
	The protocol for creating such a channel may be SIP based on 
	external to SIP and after we have such a mechanism we can decide
if we 
	will use SIPS for messages that need to go over the secure
channel 
	or we will use new URI type (e.g. SSIP) or just use some 
	header in the SIP message. 
	
	The other alternative is the usage of S/MIME which has its
drawbacks as 
	we can see in another thread. 
	
	Other then a secure channel or S/MIME I do not think that it
will be 
	possible to send a SIP message and get real assurance that the
message 
	will be sent securely in every hop. 
	
	--Avshalom 

31/10/2006 18:51 

To

cc

Subject

 

	

	> airbrushed in to get past the IESG.
	
	I'm very tempted to endorse this, but I think you're missing one
thing.
	
	Flimsy as it is, I believe that sips: is as strong as the rest
of the  
	current SIP security model since it depends on the same trust  
	assumptions.

	This is not trivial. Many people would argue that it would turn
SIP  
	into a fundamentally different protocol. I think it needs to be
done,  
	but I also think we need to clearly document how the current
trust  
	model (including sips:) works, because that's what's going to be

	assumptions. My current hope is we can do some work there that
can be  
	"ported back" into SIP.
	
	--
	Dean
	
	_______________________________________________
	Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
	This list is for NEW development of the core SIP Protocol
	Use [email-masked] for questions on current
sip
	Use [email-masked] for new developments on the application of
sip

---

From: Dean Willis <[email-masked]>
Date: Wed, 1 Nov 2006 14:38:05 -0600

> then the SIP signalling can go securely over the channel.

See:

http://www.ietf.org/internet-drafts/draft-gurbani-sip-sipsec-00.txt

which does exactly what you're describing.

--
Dean

---

From: "Samir Srivastava" <[email-masked]>
Date: Wed, 1 Nov 2006 14:42:48 -0600

My issue with this proposal is what headers are open to proxies to route
the initial request. I feel
To/From/CallId/ReqUri/Cseq/MAX-FORWARD/via/RecordRoute/Proxy-Require
etc..

Thx
Samir

> -----Original Message-----
> From: Dean Willis [mailto:[email-masked]]
> Sent: Wednesday, November 01, 2006 12:38 PM
> To: Avshalom Houri
> Cc: [email-masked]
RE:
> [Sip] RE: TLS meaning))
should

---

From: "Samir Srivastava" <[email-masked]>
Date: Wed, 1 Nov 2006 14:42:48 -0600

Thx
Samir

should

---

From: Ed Pimentel <[email-masked]>
Date: Wed, 1 Nov 2006 09:58:51 -0500

What is missing is the concept of a federated SAML / OpenID / Yadis   
"iD Provider"
Or even an adaptation of what was with H.350 (Internet2.0) but  for  
P2P-SIP
Sincerely,
-EdPimentl

On Nov 1, 2006, at 9:40 AM, Peter Pan wrote:

> The disentrance for a secure channel is sweet. It seems to me the  
> first of
> the keypoints that will make P2PSIP win. SIP itself seems never one :(
>
> Peter
> ----- Original Message -----
> From: Henry Sinnreich
> To: Avshalom Houri ; [email-masked]
> Subject: Re: [p2p-sip] What consensus? (was: What controls the lock
> icon?(Was RE:[Sip] RE: TLS meaning))
>
>
> Avshalom Houri writes:
>
> As you correctly conclude, P2P SIP has the opportunity to finally  
> make SIP
> secure.
>
> Thanks, Henry
>
>
>
>
> 31/10/2006 18:51 ToMichael Thomas <[email-masked]>
> cc"Joel M. Halpern" <[email-masked]>, "'IETF SIP List'"
> SubjectRe: What consensus? (was: What controls the lock icon? (Was  
> RE: [Sip]
> RE: TLS meaning))
>
>
>
>
>
>
>
>
>
> p2p-sip mailing list
> [email-masked]
> https://lists.cs.columbia.edu/cucslists/listinfo/p2p-sip
>
> p2p-sip mailing list
> [email-masked]
> https://lists.cs.columbia.edu/cucslists/listinfo/p2p-sip

---

From: "Peter Pan" <[email-masked]>
Date: Wed, 1 Nov 2006 06:40:07 -0800

The disentrance for a secure channel is sweet. It seems to me the first of
the keypoints that will make P2PSIP win. SIP itself seems never one :(

Peter
----- Original Message -----
From: Henry Sinnreich
To: Avshalom Houri ; [email-masked]
Cc: [email-masked]
Sent: Wednesday, November 01, 2006 5:52 AM
Subject: Re: [p2p-sip] What consensus? (was: What controls the lock

>will be sent securely in every hop.

As you correctly conclude, P2P SIP has the opportunity to finally make SIP
secure.

Thanks, Henry

--Avshalom

SubjectRe: What consensus? (was: What controls the lock icon? (Was RE: [Sip]
RE: TLS meaning))

--
Dean