Subject: [Sipping] Re: I-D ACTION:draft-greco-sipping-roaming-01.txt

From: Paul Kyzivat <[email-masked]>
Date: Thu, 12 Jul 2007 18:38:28 -0400

Interesting draft. It would be great if something with this 
functionality can be institutionalized.

I have one question:

According to section 3, the user must use a secure channel to 
communicate the token to the ISP. Presumably this is so that the token 
doesn't fall into the hands of somebody else who might use it to run up 
services on the user's tab.

That means that the user must trust the ISP. But how does the user know 
if it is talking to an ISP it can trust? A bad guy masquerading as an 
ISP could get the user to divulge his token.

It seems to me that there is something missing here.

	Thanks,
	Paul

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: silvana <[email-masked]>
Date: Sat, 14 Jul 2007 01:43:59 +0200

HI Paul,
thanks for your comments.
You are right, we need to clarify how the user has to authenticate the ISP.
I will take care of this aspect,
Thanks
Silvana

> It seems to me that there is something missing here.

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

---

From: [email-masked]
Date: Fri, 20 Jul 2007 08:07:56 -0400

From: Paul Kyzivat <[email-masked]>

Sounds like you need a zero-knowledge proof of identity here.

Dale