Subject: [Sip] Requesting feedback on draft-dotson-sip-certificate-auth-01

From: "Steve Dotson" <[email-masked]>
Date: Tue, 21 Nov 2006 10:34:47 -0700

Some industries and organizations have invested in PKI, and thus have
certificates available for authentication. We would like to leverage
those credentials for SIP authentication. Using certificates instead of
UICCs or other credentials is attractive for certain deployment models.
http://www.ietf.org/internet-drafts/draft-dotson-sip-certificate-auth-01
.txt describes some requirements related to this issue, as well as a
review of previous and related work. We have received good feedback
offline from authors of related work which were incorporated into the
latest draft.

Thanks,

Steve.

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Fries, Steffen" <[email-masked]>
Date: Thu, 23 Nov 2006 16:52:05 +0100

Hi Steve,
 
having certificates for user registration over multiple hops on a
registrar seems an interesting approach. The possibility to have a local
authentication service on the user agent would help here, but in most
scenarios, the user agent itself will not possess the domain certificate
according to RFC4474.
 
Two comments to the transport of credentials. You mentioned that SIP
identity itself does not provide for certificate transport. We are
currently working on an update of a draft targeting a BCP for credential
transport in SIP using SIP identity
(http://www.ietf.org/internet-drafts/draft-fries-sip-identity-usage-bcp-
00.txt). Our draft also mentions the usage of SIP SAML to transport an
assertion or a reference to an assertion, which may be interesting in
your scenario as well. A SAML assertion could be provided by a local
server, which in turn may be used to register the UA. 
 
Ciao
    Steffen

________________________________

	From: Steve Dotson [mailto:[email-masked]] 
	Sent: Tuesday, November 21, 2006 6:35 PM
	To: IETF SIP List
	Subject: [Sip] Requesting feedback on
draft-dotson-sip-certificate-auth-01

	Some industries and organizations have invested in PKI, and thus
have certificates available for authentication. We would like to
leverage those credentials for SIP authentication. Using certificates
instead of UICCs or other credentials is attractive for certain
deployment models.
http://www.ietf.org/internet-drafts/draft-dotson-sip-certificate-auth-01
.txt describes some requirements related to this issue, as well as a
review of previous and related work. We have received good feedback
offline from authors of related work which were incorporated into the
latest draft.

	Thanks,

	Steve.