Subject: [Sip] SIP Security: Client certificates

From: "Mahey, Sonit" <[email-masked]>
Date: Mon, 11 Feb 2002 11:17:06 -0500

Henning,

In the draft "Draft-schulzrinne-sip-security-00.txt", you make an
assumption: Client certificates are less likely to be available than server
certificates. 
I argue that this is not true since SET (Secure Electronic Transaction) uses
(credit) cardholder's certificates. I grant that this does not cover the
entire population, but from a VoP service provider's perspective, it would
not be off the mark to assume that most (~95%-98%) subscriber's -
prospective and current - would have a credit card.

- sonit

Sonit Mahey,
Architect - Voice Business Unit,
Unisphere Networks,
10 Technology Park Drive,
Westford, MA 01886,
USA.

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jari Arkko <[email-masked]>
Date: Mon, 11 Feb 2002 18:24:53 +0200

> prospective and current - would have a credit card.

I'm not sure what you are saying. I have a credit card
but I do *not* use SET and as far as I know, I don't
have a certificate because of the credit card. Or
perhaps you are saying that SET acts as a credential
creation tool, input your card number (and $10) and
out comes a cert?

If so, there are also a number of other potential
sources of certificates that we could bootstrap
ourselves into. Most ISPs apply some sort of authentication;
you could use PIC to generate certs from that etc.
However, I'm still not convinced that the users
have usable certs and everything is linked through
some global co-operating roots.

In conclusion I agree with Henning on this.

Jari

---

From: Eric Rescorla <[email-masked]>
Date: 11 Feb 2002 08:25:00 -0800

> prospective and current - would have a credit card.

SET's deployment could be charitably described as underwhelming.

The probability that any given credit card holder will have a SET
certificate is somewhere between vanishing and nonexistent.

-Ekr

-- 
[Eric Rescorla                                   [email-masked]]
                http://www.rtfm.com/