Subject: RE: [Sip] A sips: trial balloon for you to shoot down

From: "Attila Sipos" <[email-masked]>
Date: Thu, 2 Nov 2006 08:00:06 -0000

>> > There is a benefit in having secure SIP being used upto
>> > the PSTN gateway.
>> >
>> 
>> Sure. And with the description of sip: URI processing given earlier  
>> (it will be secured if it can be secured) then sip: gives 
>> you as good  
>> of security as you would get by lying about your compliance with  
>> sips:. So placing a call using a sip: URI to the PSTN gateway would  
>> produce secure SIP.

In your orignal "A sips: trial balloon for you to shoot down" you
said:

>>1) Implementations of SIP SHOULD use TLS as described in RFC 3261 for  
>>all SIP traffic, including traffic using a sip: URI scheme. Failure  
>>to use TLS may result in disclosure of sensitive signaling  
>>information to third parties.

>>In other words, if you're willing to settle for the best  
>>security that can actually be provided, simply originate the request  
>>with a sip: URI scheme.

So, what you're saying that PSTN gateways should use a
sip: URI with transport=tls?

Can we, possibly with Requires, enforce that all hops
use the TLS?

	Attila

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Dean Willis <[email-masked]>
Date: Thu, 2 Nov 2006 11:43:58 -0600

> sip: URI with transport=tls?

I think so.

> Can we, possibly with Requires, enforce that all hops

We possibly could, but that would be a new SIP extension, not part of  
the current sips: specification, and outside of the scope of what  
could be done with an informational or BCP document.

--
Dean

---

From: "Francois Audet" <[email-masked]>
Date: Thu, 2 Nov 2006 13:19:27 -0600

> -----Original Message-----
> From: Dean Willis [mailto:[email-masked]] 
> Sent: Thursday, November 02, 2006 9:44 AM
> To: Attila Sipos
> Cc: IETF SIP List
> Subject: Re: [Sip] A sips: trial balloon for you to shoot down
> 
> 
> Attila aksed:

That would require a normative change to RFC 3261 which has 
deprecated transport=tls.

Furthermore, I think this is a bad idea to be honest. I'd rather
have the suggestion that someone made that requests with SIPoverTLS
be forwarded to SIPoverTLS by proxies.

I think we have 4 choices for PSTN Gateways:

1 - SIPS is only valid if all hops are withing a SIP network. PSTN
    gateways would therefore not use SIPS. Gateways to H.323 wouldn't
    either, even if H.323 is secured (same thing for other protocols).

2 - SIPS is valid withing an IP network. H.323 gateways could 
    use SIPS, provided they are using an equivalent security level on
    the H.323 side. PSTN gateways gateways would therefore not use SIPS.

3 - SIPS is significant only withing a SIP network, and hop-off to PSTN
    or other networks such as H.323 ARE allowed (in the case of H.323,
it would
    require security). 

4 - SIPS is significant only withing a SIP network, and hop-off to PSTN
    or other networks such as H.323 ARE allowed and in both cases, you
    would require the gateway network to use security. 

I think Brian Rosen favored 4. Personally, I prefer either 1 or 2.

There are quite different however. 

1 is my farorite choice if we think that sips has a limitted life-span
and
will have limited deployment, and will eventually be replaced by
something better.

2 is my favorite if we believe sips has a more long-term future.

> > Can we, possibly with Requires, enforce that all hops use the TLS?
> 
> We possibly could, but that would be a new SIP extension, not 
> part of the current sips: specification, and outside of the 
> scope of what could be done with an informational or BCP document.

Right.

Subject: RE: Updated: Harpooon IPT Core Team Meeting
From: "Bermel, Karl \(CAR:9P40\)" <[email-masked]>
To: "LeBlanc, Vicki \(CAR:4802\)" <[email-masked]>, "Brookes, Russ \(BVW:9X62\)" <[email-masked]>, "Knowles, Gregory \(NCRTP:4470\)" <[email-masked]>, "Taylor, Christopher \(CAR:9P91\)" <[email-masked]>, "Alvarez, Carlos \(NGD:8544\)" <[email-masked]>, "Potts, Brian \(BRAM:9731\)" <[email-masked]>, "Howard, Dave \(BVW:9X62\)" <[email-masked]>, "Jones, Kenneth \(NCRTP:4470\)" <[email-masked]>, "Knight, Diane \(BL60:9115\)" <[email-masked]>, "LaViolette, Denise \(BVW:4802\)" <[email-masked]>, "Shepherd, Frank \(SAMH:3065\)" <[email-masked]>, "Bree, Paul
Date: Thu, 2 Nov 2006 09:33:45 -0600

Folks

Notwithstanding the minor NCR (that will be corrected) we did very well - as expected - on the ISO audit this week.  Good job to everyone on the team, and thanks to everyone involved, especially Vicki who has been keeping us honest wrt TTM process and quality.

Karl Bermel 
(613) 763-9305 (ESN 393)
[email-masked]

  <<RE How did MCS 5100 Release 4.0 finish.htm>>

---

From: "Brian Rosen" <[email-masked]>
Date: Thu, 2 Nov 2006 15:14:05 -0500

I favor 2, I can live with 1.  "only valid" means fail if you can't maintain
it.  So, a gateway to H.323 acting as a UAS would fail a sips INVITE if 1
was the policy, and allow it if 2 was the policy AND it could maintain TLS
throughout the H.323 signaling path.  I'm not in favor of 3 or 4.

Brian

> From: Francois Audet [mailto:[email-masked]]
> Sent: Thursday, November 02, 2006 2:19 PM
> To: Dean Willis; Attila Sipos
> Cc: IETF SIP List
> Subject: RE: [Sip] A sips: trial balloon for you to shoot down
> 
> 
>