Subject: RE: [Sip] verifying identity of sender

From: "Peterson, Jon" <[email-masked]>
Date: Wed, 6 Oct 2004 19:09:28 -0400

Juha,

>  > However, the
>  > insecurity of the DNS at the moment makes these sorts of approaches
>  > problematic. Also, I think the security community is deeply suspicious
of
>  > attempts to reinvent the certificate construct in some other way. This
is
>  > what certificates are for: if we need this property, we should use
>  > certificates.
> 
> i didn't try to propose any new certificate construct.  uas would just
> send a verification request to the proxy of the domain and would get
> back a reply.

I didn't mean that you were proposing a new model for certificates - I meant
that you were trying to propose a new way of getting the same properties
that we get from certificates. I think that is unnecessary and potentially
very dangerously.

> implementation of tls in the proxy is one thing and getting a
> certificate for it that is verifiable to a known CA is another thing.  i
> can imagine that large operators can do it, but not small companies and
> private people who use sip more or less in peer-to-peer mode.
> 

Anyway, implementation has nothing to do with this. If you don't -do- TLS,
you can't provide an Identity header; or rather, the assertion that Identity
provides is valueless.

Look, this isn't something where every user of a domain needs their own
certificate, or something. This is a case where you need one cert for one
domain. How much do certs cost? Probably as much as $350 a year, down to as
little as $40 dollars a year. I'm sorry, but compared to the cost of
operating a server, bandwidth, etc etc, I don't think this is such a
tremendous impediment.

Jon Peterson
NeuStar, Inc.

> -- juha

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip