Subject: [AVT] Doubt about RFC 3830‏ - SIGNi payload

From: Agustin Cozzetti <[email-masked]>
Date: Mon, 10 Dec 2007 15:16:45 +0000

Hello,
I have a doubt about SIGNi payload in RFC 3830.
This payload carries the signature of all previous payload in the DH exchange messages. Is it right?
What should be used to sign the message (key?label?) ??? The client and server don't have a pre-shared secret and certificates.
Thank you for your help, Hector Agustin Cozzetti 
_________________________________________________________________
Scarica GRATIS le emoticon della tua squadra del cuore e il calendario di serie A!
http://www.emoticons-livemessenger.com/pages/msnitcalcio/index.htm

_______________________________________________
Audio/Video Transport Working Group
[email-masked]
https://www1.ietf.org/mailman/listinfo/avt

---

From: "Dan Wing" <[email-masked]>
Date: Wed, 12 Dec 2007 08:28:53 -0800

> -----Original Message-----
> From: Agustin Cozzetti [mailto:[email-masked]] 
> Sent: Monday, December 10, 2007 7:17 AM
> To: [email-masked]
> Subject: [AVT] Doubt about RFC 3830‏ - SIGNi payload
> 
> Hello,
> What should be used to sign the message (key?label?) ??? The 
> client and server don't have a pre-shared secret and certificates.

MIKEY-DHSIGN (RFC3830) requires certificates, and MIKEY-DHHMAC (RFC4650)
requires pre-shared keys.  If you have neither, you could invent your own
MIKEY method that just used DH and crossed fingers that no man-in-the-middle
got involved, or you could use RFC4474 to provide protection against
man-in-the-middle.

You might also be interested in:

http://tools.ietf.org/html/draft-ietf-msec-mikey-applicability-06
http://tools.ietf.org/html/draft-ietf-sip-media-security-requirements-01#appen
dix-A.1.5
http://tools.ietf.org/html/draft-ietf-sip-media-security-requirements-01#appen
dix-A.1.6

-d