Subject: RE: [Sip] SIP-TLS Travesty (another perspective)

From: "Christian Huitema" <[email-masked]>
Date: Mon, 18 Feb 2002 12:18:50 -0800

> Here is what I don't seem to understand about SIP
> and TLS. SIP is trying to make TLS a 'MUST'.
> I feel this prevents individuals from hosting
> their own SIP domains. One has to go through hoops
> to get a certificate from Verisign etc. etc.
> Actually as an individual you simply cannot get a
> security certificate (type 3?). Even as a business
> there are some requirements before a cert is issued.
> Once issued you must pay $400/year maintenance fees.

Does not have to be so -- there are multiple certification authorities.
Besides, if you use S/MIME, you also need a certificate...

-- Christian Huitema

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Chris Martin <[email-masked]>
Date: Mon, 18 Feb 2002 23:07:39 -0600

> Besides, if you use S/MIME, you also need a certificate...

Just for my own info, since I did jump in in the middle of this thread,
are we discussing the authentication mechanism of SIP and/or the
encryption of certain SIP headers?

And as Christian points out all of the mechansims, even IPSec can
utilize certs...and there are many ca's out there, including the fact
that anyone can create their own certificate and sign it, this is a
danger in itself, but if we are merely wanting to protect the
information in transit this method could be utilized to perform this
function, as many web sites do today, many of them are not signed by a
trusted ca, yet the users typically accept them anyway....bad move as
this may be, it is fairly simple and semi-transparent for the average
user to have a slight bit of security.

---

From: Chris Martin <[email-masked]>
Date: Mon, 18 Feb 2002 23:25:24 -0600

Chris Martin wrote:
> And as Christian points out all of the mechansims, 
Christian points out SMIME, I am adding the rest...before everyone reads
this and says...Christian didnt point that out... I am merely adding to
his statement....   :^)

even IPSec can