Subject: [Sip-security] Summary Minutes from BOF

From: "Cullen Jennings" <[email-masked]>
Date: Thu, 13 Dec 2001 09:34:27 -0800

If you only take one thing out of this meeting - it should be "Go read the
stuff from Eric and Mike."

http://search.ietf.org/internet-drafts/draft-rescorla-sec-cons-03.txt

http://search.ietf.org/internet-drafts/draft-thomas-sip-sec-req-00.txt

http://search.ietf.org/internet-drafts/draft-thomas-sip-sec-framework-00.txt

There is going to be a Design Team to look at the trying to put together
some improved security requirements. Requirements includes all SIP security
issues including things like Refer. Once we have requirements, we will
prioritize. Goal is to improve bis security by Jan 02. If you want to
volunteer for this design team, email [email-masked]. It's going to
be small - it's going to include people who know sip and security people. It
will be selected by the Chairs.

The mailing list for this stuff is [email-masked] and you can
subscribe by sending an email with the word subscribe in it to
[email-masked] (Of course this is the only place I am going
to send this email so I'm not sure this helps much :-)

Now to get into a bit more about what happened ....

It was pointed out it would be nice to define the following:
* who the participants are
* who the attackers are
* what is the trust relationship between parties

There are two types of environments we are initially interested in
Type 1
A phone service provider where first hop goes from subscriber to service
provider.

Type 2
Like above but add mobility so first hop can be from a subscriber to a
visited network then to home a service provider.

Also some people want end to end secure calls

The definition of a trust relationship is who is allowed to do what and
under what circumstances.

Our first goal is to figure out the requirements for security not work on
the mechanism.

We spent considerable time working through the basic model of how SIP might
work and looked at the Jack-in-the-box from the Thomas draft.

It was pointed out that if we never modified headers but only appended new
ones, some security things would be much easier.

We have not decided what headers need to be covered by and integrity check.

We do want to call people that you don't know and have no trust relationship
with.

Reasonable End to end post dial delay is a requirement.

Integrity detection is going to be very important

Jon, Jonathan, Brian R, Cullen and others offered to spend time to help
explain SIP to any of the security folks.

Looked at some scenarios provided by Jari Avkko. Fist one has all network
elements are in the same company. Second is service provider. Third is
network is evil trust nobody model but still want security with friends.

It is a requirement to be able to negotiate different mechanisms.

There is an email that compares Thomas draft to 3GPP requirements.

The scenario with 2 providers and with thing in the middle that is not
trusted is an important and hard one scenario.

We have multi-users problems but do not have multicast security issues.

We then moved on to some slides from Vesa Torvinen that compare 3GPP and
Thomas requirements.

3GPP wants long term secret keys (from/with AAA) and faster short term keys.

Binging up AAA is interesting. Asking for delegation means that AAA servers
provide trust between client and other services. AAA does not do this today
but it is a requirement they are interested in. This is all very Kerberos
like.

Mike pointed out that this is a requirement to other groups like kerberos.

Issues raised of negotiating security in a secure way.

Rohan explained a common deployment model. Where a Phone (A) goes to proxy B
which goes to proxy C which goes to proxy D which goes to PSTN gateway E.
The transport from A to B is TLS then IPSec is used to C then TLS to D which
is in the same secure network and trust domain as E. A is in one trust
domain, B in another, C in another, D and E in the another. B authenticates
itself to A by certificate in TLS. A authenticates to B using Digest. C
trusts traffic it gets from B over IpSec. D could make A separately
authenticate to it using Digest. RTP traffic flows from A to D. Things
somewhat like this are deployed.

List of attendants - I apologize for the huge number of typos in this but I
believe there is enough info to search the email archives and figure out
what was there.

Jorg Ott [email-masked]
Jonathan Rosenber [email-masked]
Jor Arkko [email-masked]
Jiguel A FGarcia [email-masked]
Sunnil Chotai [email-masked]
Vesa Torvinen [email-masked]
Keith Drange [email-masked] (who wins the prize for most clearly printed
name)
Giuseppa Ricejim [email-masked]
Mark Watson [email-masked]
Mary Barnes [email-masked]
Dan Petrie [email-masked]
Jaysshree Bharatia [email-masked]
Aki Neimi [email-masked]
Oris Levin [email-masked]
Sasha Ruditski [email-masked]
Itamor Gilad [email-masked]
Dirk Kreslbey [email-masked]
Georg Hayer [email-masked]
Xin Chen [email-masked]
Kristain Kiss [email-masked]
jorge R Cuellar [email-masked]
Hannos Tschofeng [email-masked]
James M Polk [email-masked]
Alan Johnsof [email-masked]
James Underly [email-masked]
SharadheVijay [email-masked]
Helen Hwa-Jung Han [email-masked]
Guarglu Want [email-masked]
tin dao truung [email-masked]
Dean Willis [email-masked]
Bill Marshal [email-masked]
Kijoaska Shinoda [email-masked]
Souhwan Jung [email-masked]
Ben Campbell [email-masked]
Jiri Kdlhari [email-masked]
Hugh Shei [email-masked]
Cerdirc Aucoc [email-masked]
Wlfgang Beck [email-masked]
Laura Liess [email-masked]
Adan Roach [email-masked] (vote now for you favorite address
[email-masked], [email-masked], [email-masked] )
suresh Levoy [email-masked]
Wolfoang Klasen worlgeo.klausen.mchp.siemens.com
Martin Erichmen [email-masked]
Senhil Sengoadan [email-masked]
Mahfour Rhamam [email-masked]
Dennis Beard [email-masked]
Tom Taylor [email-masked]
Brina Stucker [email-masked]
Cullen Jening [email-masked]
Rohan Mahy [email-masked]

The following names I tried to get right because the seemed like people
someone might actually want to email about any of this stuff. I may have it
all wrong who is in security or not.

Brian Rosen [email-masked] (chair)
Jon Peterson [email-masked] (working on bis secuirty section)
Allison Mankin [email-masked] (Area director)
Mike Tommas [email-masked] (sip secuirty expert)
Eric Rescorla [email-masked] (security dude)
Jackson Chan [email-masked] (security dude)
Join Loannidis [email-masked] (security dude)
Robert Moskowitz [email-masked] (security dude)
Jonathan Trostle [email-masked] (security dude)

_______________________________________________
Sip-security mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/sip-security