Subject: [Sip] Re: SIP and PKI

From: Jari Arkko <[email-masked]>
Date: Tue, 05 Feb 2002 23:26:22 +0200

Mike wrote first:

 > bis-06 implies very strongly that SIP elements
 > should use PKI based authentication. This should
 > be removed.

And then Jonathan wrote:

 > Hmm, I don't recall it saying you had to use PKI, just
 > that S/MIME is a SHOULD. Honestly, I think its useless
 > for encryption, but there is a VERY useful application
 > for authentication using self-signed certs.

There's two parts in the spec that could potentially use
PKIs: TLS and S/MIME. The usage appears to be as follows,
according to bis 07:

* TLS is expected to be run in the same manner as web security
* S/MIME is expected to be run in the same manner as SSH

So, what should we say about the debate Mike and Jonathan
were having? First, I'd like to agree with Jonathan that
the way that S/MIME is being used does not necessarily
imply PKI. I like the "opportunistic" or SSH style authentication
and I believe it's very useful for SIP. PKI is a SHOULD/MAY
in the spec for S/MIME.

Secondly, I'd like to agree with Mike that the Bis 07 does
imply PKI in another part of the text: the TLS usage. I
think the text in Bis also needs clarification to make it
more clear exactly what is being required [or I need to
to be pointed to the right place in the spec].

Regarding the PKI implication, 22.3.1 states that a
mutually authenticating TLS implementation is a MUST for
proxies. Assuming the security connection is useful, the
certificates passed from both sides have to be verified against
something. Thus, there has to be root certificates
configured somewhere, and both sides must be under
the same root. Ok, so you can use the same roots that
you use for web servers. Fine, but this is actually
the same as what you need to do in IPsec, isn't it?
The typical TLS one-sided authentication is a useful
feature, but that typically be applied UA - proxy, not
proxy-proxy...

Regarding text clarifications:

- The text says e.g. in 22.3.2.1 something about
   verifying certificates and domain names in them.
   Perhaps we should clarify that this indeed happens through
   some configured root CAs -- such as those which are the
   default in your Netscape, but some roots are needed.

- 22.3.1 sets forth requirements for UAs to verify
   certificates. Why are these a SHOULD, not a MUST?

- And why aren't there any requirements for proxies
   to do the verification?

- In 22.3.2.2 there's the following text that describes
   how to talk TLS between two proxies: "... noting the domain
   name that appears in the certificate for comparison with
   the headers of SIP messages." Maybe it is obvious, but
   I'm not sure which headers this refers to. Certainly not
   the From, since this was the transitive case. The Via,
   then? Any DNS operations in between?

- Wouldn't it be sufficient to verify *either* the From
   field against the TLS certs, or the latest via/source
   address? Then the INVITE comes from a known source in
   any case.

- 5th paragraph in 22.3.2.2 ends abruptly. Something missing?

Jari

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip