Subject: [Sip] Discussion on draft-ietf-sip-identity-03.txt

From: Dean Willis <[email-masked]>
Date: Tue, 19 Oct 2004 18:36:00 -0500

Wearing my chair hat and thinking about draft-ietf-sip-identity-03, 
which IS an approved working-group effort that WAS scheduled to be 
finished last April . . .

 From the minutes at IETF 60: "It was observed that few participants in 
the room displayed confidence in their understanding of the problem or 
the proposal, and that further study would be a Good Thing."

Since then, we have talked a lot about identity-related issues on the list.

We've hashed through some of the less-understood issues, including the 
tremendous similarity between the SIP spam problem and the SMTP spam 
problem, and Michael Thomas pointed us at the MASS work, which is 
astoundingly similar to sip-identity.

Juha contributed some ideas on techniques related to jabber-style 
dial-back auth that could be applied to get partial identity in the 
absence of a certificate deployment, which led to discussion of 
additional operational hacks that could be applied to help with the 
problem, but neither gave us a complete solution.

Jon and Cullen proved that real CS-signed certificates are readily 
available at a cost not significantly different than that of a domain 
registration, or slightly less than the price of a decent bottle of 
Scotch, for some definition of the word "decent".

So, where do we go now? Are we ready to take this document to a working 
group last call? If you think not, please explain what we need to know, 
understand, or discuss in order to make forward progress here.

Thanks,

--
Dean Willis
Co-Chair, SIP Working Group

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Michael Thomas <[email-masked]>
Date: Thu, 21 Oct 2004 16:53:18 -0700 (PDT)

>From my poor understanding, the principle
difference is what the trust anchor is. That has a
tendency to either make or break these things,
especially in the large... which is what led us to
our use of DNS as a somewhat more "conservative"
compromise of deployability over security.

But! The question that I really have is whether
anybody is implementing and especially deploying
this, and if so, obviously how it's going.  We're
getting a lot of interest on the MASS front due to
the dire situation with email which may in fact
move some of these immovable objects, so unless
people are actually making use of this, waiting to
see what happens may not be a terrible option.

 > Scotch, for some definition of the word "decent".

There's more to it than money, of course; there's
institutional, um, considerations too. And PKI's
don't have a very encouraging track record beyond
web stuff; whether it's reasonable being a
different question than whether it is.

		   Mike