Subject: RE: [Sip] verifying identity of sender

From: "Peterson, Jon" <[email-masked]>
Date: Thu, 21 Oct 2004 13:28:28 -0400

We're working towards a mid-term goal of unifying the existing sip-identity
work with the SIP-SAML draft. I suspect that the vehicle for this
unification while actually be the Identity-Info header rather than the
Identity header (i.e., Identity-Info could provide a means of accessing a
SAML assertion by reference).

However, I also believe it is critical that we aim towards a
universally-deployable, thinner identity assertion than SAML. SAML is heavy,
and requires a great deal of pre-association between the creator and
consumer of assertions. We need something that addresses the impersonation
problem but doesn't entail the sorts of smarts required to make SAML work.
So in any regime, I believe sip-identity will have a place; SAML would
provide supplemental information commensurate with its intrinsic
versatility.

Jon Peterson
NeuStar, Inc.

> -----Original Message-----
> From: Mauricio Arango [mailto:[email-masked]]
> Sent: Wednesday, October 20, 2004 10:18 PM
> To: Dean Willis
> Cc: Cullen Jennings; [email-masked]; Juha Heinanen; Peterson, Jon
> Subject: Re: [Sip] verifying identity of sender
> 
> 
> Folks,
> 
> I believe the approach described in draft-ietf-sip-identity-03,
> based on secure exchange of authentication assurances, is the right
> way to achieve end-to-end authentication among SIP entities that
> don't belong to the same administrative domain.
> 
> However, I'd like to ask of why not use an already
> standardized structure, specifically SAML, for the
> proposed Identity header? Something similar has been
> already put forward in draft-tschofenig-sip-saml, where the
> 'Network Asserted Identities' case in Figure 3  is
> the closest to the approach in draft-ietf-sip-identity-03
> (where the SAML Asserting party role is handled by
> the SIP Autentication proxy).
> 
> Benefits of using SAML include:
> 
>     - Standardized and widely adopted structure for
>       security (authentication, authorization, attribute) assertions.
> 
>     - Simplifies integration with other identity management systems.
> 
>     - Extensible, XML-based format - SIP-specific message information
>         including headers (eg. Contact, Call-ID, CSeq)
>         and the SDP body can be specified as new SAML
>         attributes.
> 
>     - Transfer of attributes associated with the asserted
>         identity, which enables trait-based authorization as
>         described in draft-ietf-sipping-trait-authz-00.
> 
> Regards,
> 
> Mauricio Arango
> 
> 
> 
> 
> 
> 
> 
> 
> 
> Dean Willis wrote:
> 
> > Peterson, Jon wrote:
> >
> > >Again, Dean, my immediate concern here is whether or not 
> this discussion
> > >about a hypothetical, partially-formulated alternative is 
> material to the
> > >progression of sip-identity-03.
> > >
> > >
> > >
> > Ahah! No, this has NOTHING to do with impeding the Identity 
> draft, as
> > far as I know. But it is a suggestion of another mechanism 
> that MIGHT be
> > useful to talk about. As far as I know, it NEVER had 
> anything to do with
> > the identity draft, but was a suggestion of another 
> technique that might
> > also be useful, and deployable in the nearer term. I think 
> we've roughly
> > concluded that the specific idea suggested has little or no 
> benefit over
> > a simpler operatioal procedure, but the exercise of that analysis is
> > probably something useful for the larger community.
> >
> > >While it is interesting to discuss alternatives that 
> provide a weaker
> > >assurance, I see no reason why the exploration of those 
> alternatives should
> > >impede the standardization of a system that seems to 
> satisfy the broader
> > >requirement.
> > >
> > >
> >
> > Me neither.
> >
> > >Ultimately, this thread was kicked off with the contention 
> that acquiring
> > >certificates is infeasible. Both Cullen and I provided 
> some data about
> > >certificate acquisition that seemed to argue that the 
> problem isn't nearly
> > >so bad. If you can get a publicly-verifiable certificate 
> for under $100 a
> > >year, then the expenditure is on the same order of 
> magnitude as acquiring a
> > >domain name. I haven't yet heard the parallel argument 
> that domain names are
> > >so expensive and administratively cumbersome that we 
> should invent a new
> > >alternative system for locating SIP servers, but in my 
> opinion, this
> > >contention would carry roughly the same weight as the 
> arguments I've heard
> > >against certificates so far.
> > >
> > >
> > >
> > Yes, but this thread SUGGESTED operational policies that, 
> in the absence
> > of universal certificate deployment, might cut down on sip-spam.
> >
> > >If there is in fact no problem with making certificates a 
> component of the
> > >identity architecture, then I'm not sure why we want to explore the
> > >specification of alternatives. Alternatives are bad, when 
> it comes to
> > >security. I continue to believe that we should set a 
> long-term goal of
> > >arriving a single mandatory-to-use identity mechanism for 
> SIP. Partial
> > >solutions will not get us where we need to be.
> > >
> > >
> > >
> > Operational procedures can be put in place in the "near end", (the
> > domain individual operators are operating and protecting), and
> > certificates gain little utility until they happen to be 
> widely deployed
> > at the FAR end, over which said operator has little 
> control. That being
> > said, there
> >
> > --
> > Dean
> >
> > _______________________________________________
> > Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> > This list is for NEW development of the core SIP Protocol
> > Use [email-masked] for questions on current sip
> > Use [email-masked] for new developments on the application of sip
> 
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Mauricio Arango <[email-masked]>
Date: Thu, 21 Oct 2004 19:52:32 -0400

Thanks for the update on unifications of the sip-identity
and sip-saml drafts. Additional commments inline:

> SAML assertion by reference).

This scheme would work, it's actually the SAML IdP (Identity Provider)
artifact binding approach.

> and requires a great deal of pre-association between the creator and

For clarification, is the comment of "SAML heavy" because of the
pre-associations only?

> provide supplemental information commensurate with its intrinsic

Sounds like a good initial approach.

Mauricio Arango