Subject: RE: [Sipping] :draft-jain-sipping-srtp-00.txt

From: "Peterson, Jon" <[email-masked]>
Date: Thu, 11 Sep 2003 12:29:26 -0400

The transitive hop-by-hop TLS security policy must be expressed by a URI
('sips') because of its interaction with the DNS - see RFC3263. A client
needs to make a decision about transport protocols (and TLS) before it
forward a request to the next hop - accordingly, we have to rely on the
advertisement of transport options in the DNS and on the setting of a
special URI scheme in the Request-URI. By way of contrast, media security
parameters are negotiated by the exchange of SIP messages, and so on. So I
don't think there's much risk of parameters and policies leaking into URI
schemes - SIPS needed to be a URI scheme because its policy is invoked
before SIP negotiation begins; surely anything related to media security can
be determined as a part of SIP negotiation.

Jon Peterson
NeuStar, Inc.

> -----Original Message-----
> From: Jari Arkko [mailto:[email-masked]]
> Sent: Thursday, September 11, 2003 6:08 AM
> To: David R. Oran
> Cc: [email-masked]
> Subject: Re: [Sipping] :draft-jain-sipping-srtp-00.txt
> 
> 
> David R. Oran wrote:
> > 
> > 
> > --On Thursday, September 11, 2003 1:39 PM +0300 Jari Arkko 
> > <[email-masked]> wrote:
> > [snip]
> > 
> >> (It might be nice if there was a new URL scheme which
> >> shows that the media streams too have to be protected.
> >> Sipss, anyone?)
> >>
> > The reason the security properties have to be indicated by 
> a url scheme 
> > for sip is because the signaling is multi-hop. Since the 
> media is end to 
> > end the policy can be indicated end-to-end as well.
> 
> Yes, this is indeed possible. The multi-hop difference is
> significant, thank you for reminding me about that...
> 
> (OTOH, I don't know if folks are using sips: also as some sort of
> user-visible indication of security being present and used, since
> the behaviour is mandated in RFCs. So it has another role besides
> being used to carry the information through intermediate nodes.
> Anyway, I don't know if adding new URL schemes is a good idea.
> Certainly, if taken to its extreme, we can't be adding new URL
> schemes for all kinds of parameter and policy decisions. That's
> why we have SDP and other carried signaling information.)
> 
> --Jari
> 
> 
> 
> _______________________________________________
> Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
> This list is for NEW development of the application of SIP
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments of core SIP
> 

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Jari Arkko <[email-masked]>
Date: Thu, 11 Sep 2003 22:29:23 +0300

> be determined as a part of SIP negotiation.

Ok, I'm convinced ;-)

Thanks,

--Jari