Subject: RE: [Sip] RFC3261 and authenticating PROXIES to other proxies & U AS - 2 possible solutions

From: "Peterson, Jon" <[email-masked]>
Date: Mon, 19 Apr 2004 19:44:23 -0400

I'm not sure you're breaking any assumption I had in mind, but...

> 
>    I can think of a pretty trivial example, I think,
>    that breaks this assumption. Suppose that I'm at
>    a public kiosk UAC and want to read my voice mail
>    back at mega.corprahome.com. The UAC would use TLS
>    and cert based credentials to the first hop proxy,
>    but my home proxie or UAS is going to want to see
>    _my_ (as in [email-masked]'s) credentials, not
>    the UAC's. And telling me personally that I
>    have to, well, use x.509 credentials is going
>    to be something of a problem as I can barely
>    remember a half way decent password, let alone
>    ~2k characters of credentials.
> 

I would not recommend that SIP users get PKI certs to vouch for their own
identities (something, as far as I can recall, that I've never recommended).
In the passage you cited, I recommended that proxy servers get PKI certs and
use them to mutually authenticate one another on a hop-by-hop basis in SIP
trapezoids, since that was the use case under discussion in Alex's mail, and
as this would rid us of an insecurity in the proposed use of Digest for
hop-by-hop proxy server mutual authentication. This is completely orthogonal
to the end-to-end or end-to-middle authentication that you describe above.
This is just middle-to-middle.

>    So it seems fairly obvious to me that you'd
>    want to use x.509 credentials if you can, but
>    the real world sez that they're not always
>    going to be feasible, so you're really to have
>    to deal with e2m, m2m, and e2e symmetric key
>    credentials for... anything you can envision
>    using asymmetric key credentials. In that case,
>    TLS is providing a useful service (keeping
>    outsiders of the conversation out), but doesn't
>    really solve a pretty important case.
> 

TLS provides an important and feasible service even for e2m-ish cases - when
a UAC authenticates itself to a proxy server via symmetric credentials like
Digest (over TLS), the proxy server authenticates itself to the UAC with
asymmetric credentials(passed in TLS). This does not require or even suggest
that users should get their own X.509 certificates - merely that users are
able to validate certificates and signatures, and so on. This is in keeping
with the baseline RFC3261 recommendations for end-user authentication
(RFC3261 26.3.2).

> 		Mike

Jon Peterson
NeuStar, Inc.

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip