Subject: Re: [Speermint] Just submitted draft-mahy-speermint-direct-peering-00

From: Cullen Jennings <[email-masked]>
Date: Tue, 1 Aug 2006 00:12:32 -0700

On Jul 21, 2006, at 1:32 AM, Klaus Darilion wrote:

> Hi Rohan!
>
> Sorry for jumping in late - I had long holidays. I have a few  
> concerns about the TLS stuff:
>
>
>> 4.1.6  Setup TLS connection
>>    Once a transport, port, and address are found, the initiating peer
>>    will open or find a reusable TLS connection to the peer.  The
>>    initiating provider MUST verify the server certificate which  
>> SHOULD
>>    be rooted in a well-known certificate authority.  The initiating
>
> How should the validation be done? You describe how the client  
> validation works, but not the server validation.
>
>>    provider MUST be prepared to provide a TLS client certificate upon
>>    request during the TLS handshake.  The client certificate MUST
>>    contain a DNS or URI choice type in the subjectAltName which
>>    corresponds to the domain asserted in the host production of  
>> the From
>>    header URI.  The certificate SHOULD be valid and rooted in a well-

Hmm - I missed this when I read Rohan's draft - nice catch. I think  
that if you use client certs, you would want to do it more like what  
is described in draft-mahy-sip-connect-reuse. My initial reaction  
would be don't use client certs in the first stab at this and add  
them later.

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint

---

From: Klaus Darilion <[email-masked]>
Date: Wed, 02 Aug 2006 10:36:23 +0200

Cullen Jennings wrote:
>> Sorry for jumping in late - I had long holidays. I have a few concerns 
>> about the TLS stuff:
>>
>>
>>>    initiating provider MUST verify the server certificate which SHOULD
>>>    corresponds to the domain asserted in the host production of the From
> Hmm - I missed this when I read Rohan's draft - nice catch. I think that 
> if you use client certs, you would want to do it more like what is 
> described in draft-mahy-sip-connect-reuse. My initial reaction would be 
> don't use client certs in the first stab at this and add them later.

IMO client certs are a MUST. If my proxy receives an incoming TLS 
request, I want to know to whom I talk. I suggest having TLS and client 
certificates as must, but remove the SIP-level domain validation.

regards
klaus