Subject: RE: [Sip] A sips: trial balloon for you to shoot down

From: "Attila Sipos" <[email-masked]>
Date: Wed, 1 Nov 2006 11:00:01 -0000

>> Furthermore, gateways to other protocols not  
>> offering equally strong protections MUST NOT exercise the sips: URI  
>> scheme. In particular, PSTN gateways MUST NOT use sips:, since the  
>> PSTN itself does not offer equivalent protections and there is no  
>> ability to determine whether the PSTN segment might be 
>> converted back to a sip: request somewhere downstream.

I don't think you will get agreement on this.

I think this rule will have to be very different.  Instead
of saying that we MUST or MUST NOT, it should be a section
on making readers aware of the security implications.
In my opinion, it's a policy thing, not a standards thing.

There is a benefit in having secure SIP being used upto
the PSTN gateway.

Regards,

	Attila

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Dean Willis <[email-masked]>
Date: Wed, 1 Nov 2006 14:36:37 -0600

> In my opinion, it's a policy thing, not a standards thing.

The 2119-language here is in the requirements of practices, not the  
requirements for a protocol design. In short, we're saying "If you  
want to honor the operational requirements of a sips: URI scheme,  
then you MUST NOT downgrade the protection of the signaling to less  
than TLS on any hop. If you do, then you have not met the  
requirements of sips:, and you are lying about your security". In  
short, you are violating the contract of transitive trust.

> There is a benefit in having secure SIP being used upto

Sure. And with the description of sip: URI processing given earlier  
(it will be secured if it can be secured) then sip: gives you as good  
of security as you would get by lying about your compliance with  
sips:. So placing a call using a sip: URI to the PSTN gateway would  
produce secure SIP.

--
Dean