Subject: [Sip] A Problem with Section 22.3.2.1 (bis-07)

From: Ofir Arkin <[email-masked]>
Date: Sat, 16 Feb 2002 18:39:13 +0000

Hi,

There were a thing or two that I remember that bothered me when reading 
Section 22.3.2.1 and forgot to put in the DRAFT paper I sent to this 
list two days ago.

One of them is the following:

Lines 4424-4425: "...When it receives the TLS certificate message, the 
UA SHOULD verify the certificate and inspect the site identified by the 
certificate...".

Two things here, the first is that the "SHOULD" is really a "MUST". Why 
do we bother that much if the certificate will not be verified?
Change from "SHOULD" to "MUST" is a must in this case :P

The second thing - INSPECT. Maybe more information here for people who 
are not familiar how, correctly, TLS is required to be implemented?

Don't forget that people that need to implement SIP not always has the 
best security background.

Just my 2c for Saturday

-- 
Ofir Arkin
Managing Security Architect
@stake, Limited.
http://www.atstake.com
email: 
[email-masked]
Tel: 
+44 (0) 207 495 7002
Fax: 
+44 (0) 207 495 7062
Mobile: +44 (0) 779 630 8632	

-----------------------------
The information transmitted is intended only for the person or entity to 
which it is addressed and may contain confidential and/or privileged 
material.  Any review, re transmission, dissemination or other use of, 
or taking of any action in reliance upon, this information by persons or 
entities other than the intended recipient is prohibited.  If you 
received this in error, please contact the sender and delete the 
material from any computer.

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip