Subject: [Sip] SIP-TLS Travesty (another perspective)

From: Danyuu Wuu <[email-masked]>
Date: Sun, 17 Feb 2002 23:28:33 -0800 (PST)

Here is what I don't seem to understand about SIP
and TLS. SIP is trying to make TLS a 'MUST'.
I feel this prevents individuals from hosting
their own SIP domains. One has to go through hoops
to get a certificate from Verisign etc. etc.
Actually as an individual you simply cannot get a
security certificate (type 3?). Even as a business
there are some requirements before a cert is issued.
Once issued you must pay $400/year maintenance fees.

I can host an SMTP server and a web server BUT I will
never be able to host a SIP domain for myself without
jumping through hoops and paying dearly. Is
that not a SIP travesty. I think SIP-TLS cannot
be a 'MUST' in the base protocol. In fact TLS
has no business to be in the base protocol. Please
keep that for "sips:".

Remember SSL is an exception on the Internet, not
a rule. SIP is making everyone run in the opposite
direction by making TLS a 'MUST'.

Please do not create requirements that create second
class citizens on the Internet.
Internet is meant to level the playing field! My SMTP
server at no cost will work with Yahoo/MSN etc. Why
not SIP? Why do I need to be a
business to do SIP.

On another note regarding TLS: When I communicate with
a brokerage account I simply do not
want my transactions to be decrypted and re-encrypted
by proxies along the path. It creates a problem of
accountability.

I guess not one is thinking about accountability when
designing security for SIP.

Too many un-thought out stuff is being rammed into the
bis :-(

I would like to see all of security stuff out of the
SIP base protocol and security as an extension. Please
don't force security on the protocol.

-Danyu

__________________________________________________
Do You Yahoo!?
Yahoo! Sports - Coverage of the 2002 Olympic Games
http://sports.yahoo.com

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 18 Feb 2002 02:54:42 -0500

please note that at 3am in the morning, my sarcasm levels
are extremely high.

Responses inline.

> has no business to be in the base protocol. Please

What I think is a travesty are people who don't read the 
specifications carefully before whining about whats 
in them. 

TLS is mandatory for proxies, yes. However, what you are
complaining about is site certificates. For proxies,
site certificates are a SHOULD, not a MUST. Thus,
you can build a compliant SIP proxy that doesn't have
site certs if you have good reason not to.

> a rule.

You must be kidding, right? So you think secure web sites
are bad??

> SIP is making everyone run in the opposite

TLS itself is easy on a server, there are many free
implementations. Please.

> not SIP? Why do I need to be a

More whining without proper reading. 

> by proxies along the path. It creates a problem of

You really have to be kidding now.

You know what I hate, when I communicate with my
brokerage house, and someone modifies my transaction
mid-stream, so that it is not accounted properly at the
server. It creates a problem of accountability.

> designing security for SIP.

I guess you are not bothering to read specifications
before you post snide remarks like this to the list.

> Too many un-thought out stuff is being rammed into the

Funny that, TLS has been in bis for a very, very long time.

Even funnier is how much un-thought out stuff is being rammed
into late comments, taking away my time, and those of the other
editors, from the many hundreds of other useful comments :-(

> don't force security on the protocol.

Ah, so you want to:

1. guarantee that sip gets laughed off the iesg agenda, right back
to the working group
2. standardize a technology without sufficient security, so that
when attacks do come, people suffer because of your irresponsibility
3. standardize a technology that people won't deploy in useful ways
because it cannot be properly secured

Sounds like a plan! Sign me up!

Thank you, Danyuu, for your fine comments.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.            72 Eagle Rock Avenue
Chief Scientist                         First Floor
dynamicsoft                             East Hanover, NJ 07936
[email-masked]                 FAX: (973) 952-5050
http://www.jdrosen.net                  PH:  (973) 952-5000
http://www.dynamicsoft.com

---

From: Eric Rescorla <[email-masked]>
Date: 18 Feb 2002 06:37:14 -0800

> direction by making TLS a 'MUST'.
I think you're failing to distinguish between MUST implement
and MUST use. The MUST for TLS is of the former category,
not the latter.

-Ekr

-- 
[Eric Rescorla                                   [email-masked]]
                http://www.rtfm.com/

---

From: "Dean Willis" <[email-masked]>
Date: Mon, 18 Feb 2002 18:16:31 -0600

----- Original Message -----
From: "Danyuu Wuu" <[email-masked]>
To: <[email-masked]>
Sent: Monday, February 18, 2002 1:28 AM
Subject: [Sip] SIP-TLS Travesty (another perspective)

> has no business to be in the base protocol. Please

Well, actually, one can use a self-signed cert, or set oneself up as a CA
and give certs to other people, using a free package like openssl. People
may not take you seriously, but it works fine for personal use or for
smaller user groups. I used this to set up imap/ssl on my self-hosted site
(hey, it runs the SIP WG supplemental web site), and it works without a
hitch. It did take me almost a half-hour of reading man pages to get set up,
so it's not trivial, but I got it done and I'm not too bright. Of course, I
might have just gotten lucky. OpenSSL looks like a pretty good package. As
Jobe-Bob Briggs says "Check it out!"

--
Dean