Subject: RE: 3GPP Arch. Why use a local proxy? (was Re: [Sip] Path scenario outside of 3GPP requirements)

From: [email-masked]
Date: Tue, 26 Feb 2002 13:13:33 -0500

From:  Tom Gray@MITEL on 02/26/2002 01:13 PM
With respect to loss of security by using an ALG at the firewall and end-to-end
encryption, wouldn't it be possible to intercept the network level signalling at
the firewall that opens pin holes as a means of breaching end-to-end security.
Isn't this scenario similar to the ALG one. There must be some degree of trust
at a firewall or its purpose is defeated.

"Christian Huitema" <[email-masked]> on 02/26/2002 12:00:10 PM

To:   "Dean Willis" <[email-masked]>, [email-masked]
cc:    (bcc: Tom Gray/Kan/Mitel)

Subject:  RE: 3GPP Arch. Why use a local proxy? (was Re: [Sip] Path scenario
      outside of 3GPP requirements)

> Well, using TLS to the coporate server wouldn't work, because I need
to
> coordinate with the SIP ALG in the proxy-firewall.

The basic answer is, get a different proxy-firewall. There are two
fundamental problems with the "SIP ALG" approach: it breaks security,
and it breaks evolution. The security requirement is pretty simple: if
you cannot rely on end-to-end signature of the message body, you don't
know to whom you are sending the media; if you cannot rely on end to end
encryption of the body, you don't know who is snooping your calls. The
evolution requirement is also pretty simple: ALG only translate what
they understand, and they tend to hard wire that; if I come out with
smellovision (as an example ;-) and the ALG does not understand it,
poof, the smell is gone. The proper architecture is to use some form of
network level signaling to securely open holes in the firewall.

> They (3GPP) have a requirement to provide, at operator discretion,
very
> strict control of network usage. It's almost as if the entire
semantics of
> ATM SVCs have been transplanted onto IP, with UNI replaced by
> application-level control.  The operators want to do
service-senstitive
> AAA
> for the traffic. It's not the Internet.

Well, you say it: what these operators want to build "is not the
Internet." On the other hand, this is the IETF, and the "I" stands
precisely for "Internet". As such, we have no requirement to placate
groups that want to develop a "not-Internet." They can develop a
specification that fits their need, say a "3G voice over IP wireless
signaling protocol"; the one thing they should not do is, try to pretend
this is an Internet standard.

-- Christian Huitema

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Christian Huitema" <[email-masked]>
Date: Tue, 26 Feb 2002 10:22:26 -0800

> With respect to loss of security by using an ALG at the firewall and
end-
> to-end
> Isn't this scenario similar to the ALG one. There must be some degree
of
> trust

At some level, every middlebox is a threat to network security.
Firewalls can definitely mount a denial of service attack -- in fact we
can argue that their main purpose is to mount a selective DOS attack
against unapproved traffic. The situation gets better if you have IPv6
and global addressing, since at least you avoid address translation,
which means that the firewall is not compelled to lie about your real
address. The situation gets even better if you can use end-to-end
authentication and encryption of the media streams.

-- Christian Huitema