Subject: RE: What controls the lock icon? (Was RE: [Sip] RE: TLS meaning)

From: "Elwell, John" <[email-masked]>
Date: Wed, 01 Nov 2006 10:37:15 +0000

> -----Original Message-----
> From: Francois Audet [mailto:[email-masked]] 
> Sent: 31 October 2006 16:48
> To: Juha Heinanen; Elwell, John
> Cc: Joel M. Halpern; IETF SIP List
> Subject: RE: What controls the lock icon? (Was RE: [Sip] RE: 
> TLS meaning)
> 
>  
> 
> > -----Original Message-----
> > From: Juha Heinanen [mailto:[email-masked]] 
> > Sent: Tuesday, October 31, 2006 1:30 AM
> > To: Elwell, John
> > Cc: Joel M. Halpern; 'IETF SIP List'
> > Subject: RE: What controls the lock icon? (Was RE: [Sip] RE: 
> > TLS meaning)
> > 
> > Elwell, John writes:
> > 
> >  > TLS is not available. So a SIPS request would get 
> > rejected. Now this is fine  > if the caller is interested in 
> > making the call only if it can be a secure  > call (whatever 
> > that means), but in many cases the caller would want to  > 
> > accept an insecure call and the UAC would have to try again 
> > with  > SIP. 
> > 
> > i don't think that signaling security alone without media 
> > security means anything to common users.  this is further 
> > justification of dropping sips.
> 
> That is absolute rubish.
> 
> There are cases where you want signalling to be secure (for
> authentication, impersonation, theft of service, etc.), but you don't
> need,
> or want, or even can have encrypted media.
[JRE] No, but you might want authenticated media. It is all very well saying
that the signalling comes from the person you think it comes from, but if
the media is coming from somewhere else, that doesn't help the average user.

John

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Francois Audet" <[email-masked]>
Date: Wed, 1 Nov 2006 11:12:08 -0600

> > need, or want, or even can have encrypted media.
> [JRE] No, but you might want authenticated media. It is all 
> very well saying that the signalling comes from the person 
> you think it comes from, but if the media is coming from 
> somewhere else, that doesn't help the average user.

Sure, but it's a different problem.

Media security and Signalling security are two different things.

SIPS is strictly about hop-by-hop signalling security with TLS. 

That's why sips != padlock item, otherwise, you'll give a false sense of
security to the "average user".