Subject: Comment on draft-ietf-sip-isup-mime-00.txt

From: "Donovan, Steven R." <[email-masked]>
Date: Wed, 22 Mar 2000 19:52:53 +0000

One quick comment on the security section of this draft.  I agree that it is
true that the security section in SIP that discusses end-to-end encryption
of the SIP message body should be sufficient to meet the security concerns
associated with carrying ISUP and QSIG message bodies.

I would, however, suggest that the following be added to the spec:

"Due to the potentially sensitive nature of the information contained in
ISUP and QSIG message bodies, the UAC SHOULD perform end-to-end encryption
on ISUP and QSIG message bodies."

This will prevent the message bodies from being interpretted when the SIP
message is intercepted or is routed to non MGC based user agents that will
normally display (or attempt to display) the message body to an end user.
It would generally not be good to have a calling number made available when
it is explicitly marked for no presentation.

Steve

---

From: Jonathan Rosenberg <[email-masked]>
Date: Fri, 24 Mar 2000 01:08:05 -0500

> on ISUP and QSIG message bodies."

Lets be careful here. It depends on the application of SIP-T. For single
provider networks among a set of  softswitches, its easy to manage keys
in such a way that e2e encryption is possible. For multi-provider, wide
area operation, e2e encryption is harder, and I'm reluctant to make it
SHOULD. It requires the originator to know the key of the ultimate
recipient before sending the request. Since the entity the request will
terminate on can't always be known ahead of time (due to forwarding or
routing to a remote gateway), this requirement is overly strong.

-Jonathan R.

-- 
Jonathan D. Rosenberg                       72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (732) 741-4778
http://www.cs.columbia.edu/~jdrosen         PHONE: (732) 741-7244
http://www.dynamicsoft.com