Subject: RE: [Ieprep] Security Requirements for SIPPING SEC-6 to SEC-10

From: "King, Kimberly S." <[email-masked]>
Date: Tue, 15 Oct 2002 11:59:08 -0400

> Kimberly said:
> >>...To, From, Organization, Subject, Priority and Via header 
> fields...
> > Aren't some of these fields important for SIP routing?  Do 
> you have an
> > example solution in mind that would protect these fields?
> 
> Ian said:
> Fields that aren't needed for routing can protected 
> end-to-end using S/MIME.
> Fields that are can only be protected hop-by-hop using a 
> protocol such as
> TLS.
> 

Okay.  I am going to bring in some technology, not to mandate solutions, but
rather so we can have a better idea of what is being requested here.

Let's assume that fields like 'TO' that are normally used for SIP routing
are to be protected.  Then Ian points out this protection can be obtained by
hop-by-hop protection (say using TLS).

I then wonder, "does this requirement then limit the solution to only
certain SIP networks?".  In other words, must all SIP proxies support
hop-by-hop protection?  

Heading to RFC 3261, I see SIPS URI is a way to accomplish secure, encrypted
transport
 to carry all SIP messages from the caller to the domain of the callee.  (It
doesn't say this is the only way, but it is one way.)

"All SIP implementations MUST support the SIP URI scheme.  Any
   implementation that supports TLS MUST support the SIPS URI scheme."

So it appears that TLS isn't mandatory.  REQ-3 indicates the mechanism
should be capable of being used in networks "that are only SIP/RTP
transparent".  Unraveling this requirement in its strongest form says the
mechanism is a valid SIP request.  (This is because we want this to pass
through in SIP/RTP networks and we are only guaranteed that valid SIP
messages will pass through these networks.)

Are there other ways to perform hop-by-hop protection that must be supported
by every SIP proxy or is there an underlying assumption about proxies here?
_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep

---

From: Henning Schulzrinne <[email-masked]>
Date: Tue, 15 Oct 2002 13:53:53 -0400

> certain SIP networks?".  In other words, must all SIP proxies support

They should as of today: Section 26.3.1 of RFC 3261 reads

    Proxy servers, redirect servers, and registrars MUST implement TLS,
    and MUST support both mutual and one-way authentication.  It is
    strongly RECOMMENDED that UAs be capable initiating TLS; UAs MAY also
    be capable of acting as a TLS server.

> So it appears that TLS isn't mandatory.  REQ-3 indicates the mechanism

See above. IPsec can be used instead, btw.

> by every SIP proxy or is there an underlying assumption about proxies here?

Since the Internet as constituted today doesn't offer a generic, 
application-independent encryption service, the answer has to be no. (By 
"offer", I mean "available to any application anywhere, from any ISP".)

As an ooperational practice, we can recommend that networks offering 
IEPREP services support confidentiality (TLS or IPsec), but this would 
be another "unfunded mandate", as they call this in Washington. As 
always, security is not binary - you have to weigh the trade-offs of 
making the call even if you don't get your favorite security solution.