Subject: [Sip] Encryption negotiation?

From: "Sean Olson (EUS)" <[email-masked]>
Date: Mon, 9 Jul 2001 11:50:03 -0500

Hi,

I have a simple question but I've been unable
to find an answer in the spec, FAQ, or mailing
list archives (though I may have overlooked 
something obvious).

When using the Encryption: header in a request,
is there a way for the UAS to reject the request
*and* indicate that the request was rejected because
the UAS was unable to decrypt the body? Should a
warning header be used? What about an option tag
for encryption? (i.e. is there a way to negotiate
support of encryption?) I would expect that many
implementations that don't support encryption
might return something like a 415 or a 400. 

Any comments?

Sean Olson
Ericsson Inc.
[email-masked]

---

From: Michael Thomas <[email-masked]>
Date: Sat, 21 Jul 2001 08:48:12 -0700 (PDT)

You might take a look at my security draft which
tries to make sense of all of this. I don't think
SIP has any way of returning an error right now, nor
any way for a UAC to indicate to the UAS that it's
response was garbled.  This may be worth exploring
more. One of the counterpoints to feeding errors
back is that you might be giving an attacker
information that it shouldn't be getting (ie,
silently discarding bogons is better). A
counter-counterpoint is that Kerberos, say,
relies on certain errors to be processed, namely
clock skew errors, so maybe it's a requirement in
some situations, and optional in others.

As far as negotiation goes, there's nothing in
there now that I know of, but the security draft
attempts to do that.

	    Mike

Sean Olson (EUS) writes:
 > <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
 > <HTML>
 > <HEAD>
 > <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
 > <META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2654.19">
 > <TITLE>Encryption negotiation?</TITLE>
 > </HEAD>
 > <BODY>
 > 
 > <P><FONT SIZE=2>Hi,</FONT>
 > </P>
 > 
 > <P><FONT SIZE=2>I have a simple question but I've been unable</FONT>
 > <BR><FONT SIZE=2>to find an answer in the spec, FAQ, or mailing</FONT>
 > <BR><FONT SIZE=2>list archives (though I may have overlooked </FONT>
 > <BR><FONT SIZE=2>something obvious).</FONT>
 > </P>
 > 
 > <P><FONT SIZE=2>When using the Encryption: header in a request,</FONT>
 > <BR><FONT SIZE=2>is there a way for the UAS to reject the request</FONT>
 > <BR><FONT SIZE=2>*and* indicate that the request was rejected because</FONT>
 > <BR><FONT SIZE=2>the UAS was unable to decrypt the body? Should a</FONT>
 > <BR><FONT SIZE=2>warning header be used? What about an option tag</FONT>
 > <BR><FONT SIZE=2>for encryption? (i.e. is there a way to negotiate</FONT>
 > <BR><FONT SIZE=2>support of encryption?) I would expect that many</FONT>
 > <BR><FONT SIZE=2>implementations that don't support encryption</FONT>
 > <BR><FONT SIZE=2>might return something like a 415 or a 400. </FONT>
 > </P>
 > 
 > <P><FONT SIZE=2>Any comments?</FONT>
 > </P>
 > 
 > <P><FONT SIZE=2>Sean Olson</FONT>
 > <BR><FONT SIZE=2>Ericsson Inc.</FONT>
 > <BR><FONT SIZE=2>[email-masked]</FONT>
 > </P>
 > 
 > </BODY>
 > </HTML>

_______________________________________________
Sip mailing list  http://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip