Subject: RE: [Sip] 'sips' URI scheme (comments on proposal?)

From: "Peterson, Jon" <[email-masked]>
Date: Sat, 16 Feb 2002 03:32:49 -0600

From an earlier mail by Jari:

     My call here could be to have a MUST for enhanced digest and
     a SHOULD for TLS, MAY for IPsec and SMIME, leaving SIP with a
     scheme that can cover both h2h/e2m/e2e protection and
     UDP/SCTP/TCP, and room for the different groups to do their
     favorite thing in addition.

We have a MUST for Digest; I'm not sure what exactly 'enhanced Digest' here
means. There have been a number of proposals for Digest enhancement, as well
as a number for Digest replacement (I would group EAP and Digest-as-SASL in
this category). Is there a particular draft that is the winner? Given that
this matter seems somewhat contentious, I'm not sure this is necessarily a
more expedient route than developing the mechanisms currently in the
specification. Anyway, we do explicitly mention in the spec that there is
work towards the enhancement of Digest underway that may increase the
applicability of Digest to the threats facing SIP.

On MAY vs. SHOULD for S/MIME, this is undeniably a contentious point. Note
that we have paired the RECOMMENDED functionality down a bit, in so far as
the support for S/MIME is broken into a MUST for support for signed-data and
certs-only smime-types, but a MAY for the enveloped-data smime-type.
Although this hasn't received a great deal of attention on this list, I
believe this does represent a reduction in the amount that the SHOULD for
S/MIME really recommends that one implement. Certainly, no one is saying
that S/MIME is the highest priority, but there are genuine threats that it
addresses.

Overall, we have tried in bis to separate the normative strengths for
supporting particular security components from functional description of the
components themselves; today section 22.3.1 is home to the list of the
protocol requirements. In the course of IETF last call these variables may
be modified as the IESG sees fit. I think that they, ultimately, will be the
arbiters of how these normative strengths shake out. We've probably tuned
this about as much as we can in the SIP WG.

Jon Peterson
NeuStar, Inc.

> -----Original Message-----
> From: Jari Arkko [mailto:[email-masked]]
> Sent: Friday, February 15, 2002 11:05 PM
> To: Michael Thomas; EKR
> Cc: Michael Thomas; Peterson, Jon; Juha Heinanen; Jonathan Rosenberg;
> Lawrence Conroy; Henry Sinnreich; [email-masked]
> Subject: Re: [Sip] 'sips' URI scheme (comments on proposal?)
> 
> 
> 
> Mike wrote in an answer to Eric:
> 
> >  > Michael, one of the things that draft authors do is put text into
> >  > drafts so that it can be debated by the WG. As for the changes
> >  > being of dubious utility, I know it's hard for you to believe,
> >  > but people might have different opinions from you about utility.
> > 
> >    Fine. Let's have a consensus call. 
> 
> Well, I counted myself, Juha, Sanjoy, and Mike already supporting
> my ealier priority list which concluded that S/MIME is not the highest
> priority. At least Jonathan, Eric, and Jon have the opposite view so
> at present the no-S/MIME group is slightly larger but we really don't
> have any consensus.
> 
> But I have a compromise suggestion. Why don't we keep the S/MIME
> stuff in Bis but make it a MAY, and then move on to continue to the
> discussion about relative priorities of Digest, Enhanced Digest, TLS,
> and IPsec?
> 
> Jari
> 
> 
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Jari Arkko" <[email-masked]>
Date: Sat, 16 Feb 2002 21:07:44 +0200

> specification. 

I believe most of the folks who have proposed digest enhancements have
gotten together and joined efforts and there either is a draft in the directories
or it will appear soon. James are you listening, maybe you can post a link...

Not that digest or its enhanced version are perfect either, but nevertheless
good candidates for a mandatory mechanism. And as you point out Jon,
digest already is a MUST. That's good.

Jari