Subject: RE: [Sip] Discussion on draft-ietf-sip-identity-03.txt

From: "Peterson, Jon" <[email-masked]>
Date: Mon, 25 Oct 2004 12:04:44 -0400

Michael,

> -----Original Message-----
> From: Michael Thomas [mailto:[email-masked]]
<snip>
>  > problem, and Michael Thomas pointed us at the MASS work, which is 
>  > astoundingly similar to sip-identity.
> 
> >From my poor understanding, the principle
> difference is what the trust anchor is. That has a
> tendency to either make or break these things,
> especially in the large... which is what led us to
> our use of DNS as a somewhat more "conservative"
> compromise of deployability over security.
> 

Right. Just to articulate to the group what that distinction is, IIM
(Michael's proposal in MASS) uses the records in the DNS to point to a key
store where you can find (uncertified) public keys for a particular user.

Certainly, I personally wouldn't recommend that you use CA-issued
certificates for IIM, precisely because your mechanism manages keys on a
per-user basis. Getting PKI to end users (in terms of enrollment and
credential distribution) is very tricky. Hence, using uncertified or
self-signed keys for your architecture makes more sense. We do that for
end-users in SIP, too (in the jennings-certs draft).

That much said, it is much harder to prove that you are a user than to prove
that you are a domain. In your architecture, the DNS is used to bind
credentials to the issuing domain rather than a certificate. If, say, you
required people to access your key store via HTTPS, then there would be
little difference between the trust anchors of our approach. I'm surprised
that this doesn't even merit a MAY in your proposal; while one could argue
that the DNS is sufficiently secure, it is certainly not unrealistic or
operationally challenging to use HTTPS.

> But! The question that I really have is whether
> anybody is implementing and especially deploying
> this, and if so, obviously how it's going.  We're
> getting a lot of interest on the MASS front due to
> the dire situation with email which may in fact
> move some of these immovable objects, so unless
> people are actually making use of this, waiting to
> see what happens may not be a terrible option.
> 

I understand that there are some implementations underway, but I don't know
about deployments.

While my high-level message-identity draft shows the higher layer
commonality between the identity needs of SIP and email, it also throws a
lot of the differences into relief. After going through that exercise, I'm
not sure I would make the same recommendations for SIP and email identity.
But of course, it wasn't the point of the draft to show that MASS should use
sip-identity or that SIP should use DomainKeys or IIM or what have you - it
was to show a common design space in which the trade-offs are clear.

>  > Jon and Cullen proved that real CS-signed certificates are readily 
>  > available at a cost not significantly different than that of a domain 
>  > registration, or slightly less than the price of a decent bottle of 
>  > Scotch, for some definition of the word "decent".
> 
> There's more to it than money, of course; there's
> institutional, um, considerations too. And PKI's
> don't have a very encouraging track record beyond
> web stuff; whether it's reasonable being a
> different question than whether it is.
> 

You and I are in perfect agreement that the traditional manner of leveraging
PKI to support messaging has proved inadequate. Of course, I take exception
to the idea that sip-identity relies on certificates in that manner - it is
not predicated on enrolling individual users of the system and distributing
certified credentials to these users. In fact, it uses certificates the same
way that "web stuff" does - servers have 'em, users and other servers
validate 'em. This is a tried and tested approach to enrollment into PKI,
and tons of commercial services make these certificates available. I'm not
sure what limiting institutional considerations you have mind.

Jon Peterson
NeuStar, Inc.

> 		   Mike
> 
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip