Subject: [Sip] bis-80 security requirements

From: Phil Reynolds <[email-masked]>
Date: Fri, 22 Feb 2002 11:06:50 -0000

pdf line 5965: Proxy servers, redirect servers, and registrars MUST
implement TLS

Am I missing something or does this break all existing SIP network-elements?

---------------------------------------------------------
Phil Reynolds
Ridgeway Systems and Software
Tel: +44 118 938 1211
Fax: +44 118 935 4444
mailto:[email-masked]
http://www.ridgewaysystems.com

---

From: Jonathan Rosenberg <[email-masked]>
Date: Fri, 22 Feb 2002 11:28:27 -0500

Phil Reynolds wrote:
> Am I missing something

Certainly.

> or does this break all existing SIP
> network-elements?

First off, this requirement was in bis-07. And bis-06. That means you
have had a month to say something. Thank you for your timely feedback.
Its not like we are on a schedule or anything.

Secondly, you are most certainly wrong. An element which decides to send
using TLS as a hBh mechanism (as its described in older versions of bis)
will need to use DNS to look for SIPS NAPTR records; presuming you don't
have any since you have a server that doesn't support TLS, then UDP or
TCP will be used. Default in the absence of anything remains UDP as it
has always been. I recommend you actually read some of the documents we
are producing, rather than make bold sweeping claims which tend to
generate lots of FUD.

If you want to participate in loose routing, you'll need to do TLS in
case someone has decided to loose route to a sips resource through your
proxy. As loose routing is new, and it is known you can't loose route
through unknown (in the sense of loose v. strict) elements, its not an
issue anyway.

Initiating a call to a sips resource will also require TLS (and sips)
support for outbound proxies in front of the element that owns that URI.
However, as there are no sips URIs being handed out yet, its not an
issue. There is fallback (with user prompting preferred) should a sips
resource be called when a non-bis proxy sits in front, so their is a
reasonable migration story.

I will also note that TLS has been in bis itself for quite some time.
We've found it particularly helpful for many network scenarios that we
have used our products in. I suspect that, in fact, many mature proxy
server products do support it.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.            72 Eagle Rock Avenue
Chief Scientist                         First Floor
dynamicsoft                             East Hanover, NJ 07936
[email-masked]                 FAX: (973) 952-5050
http://www.jdrosen.net                  PH:  (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip