Subject: [Sip] Security roadmap draft

From: Henning Schulzrinne <[email-masked]>
Date: Tue, 07 Aug 2001 04:41:47 -0700

http://www.cs.columbia.edu/~hgs/sip/drafts/security_roadmap.txt

This is a rough draft, not nearly as thorough as Michael Thomas' draft.

_______________________________________________
Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jari Arkko <[email-masked]>
Date: Tue, 07 Aug 2001 18:03:22 +0300

Hi,

I'd like to announce a draft we have produced on the use
of an extensible authentication scheme for SIP. We hope
to be able to talk about this in the SIP Security Bar BOF
on Wednesday, and I believe it will also be touched upon
in the 3GPP presentation in the SIPPING WG.

Currently, SIP can use external security schemes such as
IPSec/IKE or TLS also for authentication, or one of the HTTP
and PGP methods within the protocol itself. As you know,
there is some ongoing work in the group to extend the HTTP
methods to better fit the requirements in the SIP case.
Also, AAA protocol extensions are under discussion in
the AAA WG in order to handle cases where the SIP node
doesn't store the authentication passwords by itself and
needs to talk to an authentication server over a protocol.

What we intend to add to this is one new HTTP/SIP authentication
method called HTTP EAP. Here we leverage an existing
protocol EAP (RFC 2284), originally developed for the PPP
world but nowadays being adopted also for WLANs and possibly
other places. EAP supports many authentication methods,
such password or token-card based, as well as PKI, GSM, and
UMTS AKA-based authentication schemes.

Originally, we started to think about an approach like
this as the 3G networks required the use of the UMTS AKA
authentication scheme (due to the deployed operator infrastructure
for handing out the authentication tokens for GSM/UMTS, and
the existence of the necessary technical components such
as the SIM cards already for other reasons). We could add
UMTS AKA authentication directly to SIP, but somehow we feel
that it would be better to add generic authentication to
SIP in one go, allowing various parties to use different
kinds of authentication methods they find suitable in
their situation. At the same time, an added benefit of
the EAP approach is that existing AAA protocols such as
DIAMETER and RADIUS can be used with less extension work,
as they already support EAP. Likewise, most SIP equipment
could in the future stay unchanged even if new authentication
methods are invented.

Draft: http://www.arkko.com/draft-torvinen-http-eap-00.txt
Presentation: http://www.arkko.com/sip_eap_ietf51.ppt

Feedback on this approach would be greatly appreciated,
particularly on its SIP applicability, soundness of security,
how to proceed with this in the IETF process, and the
relationship of this to the various security
proposals that the WG is now getting. We also look
forward to interesting discussions in general
about the SIP security framework.

Jari Arkko
Ericsson