Subject: RE: [Sip] verifying identity of sender

From: "Peterson, Jon" <[email-masked]>
Date: Mon, 11 Oct 2004 19:20:58 -0400

Again, Dean, my immediate concern here is whether or not this discussion
about a hypothetical, partially-formulated alternative is material to the
progression of sip-identity-03.

While it is interesting to discuss alternatives that provide a weaker
assurance, I see no reason why the exploration of those alternatives should
impede the standardization of a system that seems to satisfy the broader
requirement.

Ultimately, this thread was kicked off with the contention that acquiring
certificates is infeasible. Both Cullen and I provided some data about
certificate acquisition that seemed to argue that the problem isn't nearly
so bad. If you can get a publicly-verifiable certificate for under $100 a
year, then the expenditure is on the same order of magnitude as acquiring a
domain name. I haven't yet heard the parallel argument that domain names are
so expensive and administratively cumbersome that we should invent a new
alternative system for locating SIP servers, but in my opinion, this
contention would carry roughly the same weight as the arguments I've heard
against certificates so far.

If there is in fact no problem with making certificates a component of the
identity architecture, then I'm not sure why we want to explore the
specification of alternatives. Alternatives are bad, when it comes to
security. I continue to believe that we should set a long-term goal of
arriving a single mandatory-to-use identity mechanism for SIP. Partial
solutions will not get us where we need to be.

Jon Peterson
NeuStar, Inc.

> -----Original Message-----
> From: Dean Willis [mailto:[email-masked]]
> Sent: Monday, October 11, 2004 1:03 PM
> To: Peterson, Jon
> Cc: Cullen Jennings; [email-masked]; Juha Heinanen
> Subject: Re: [Sip] verifying identity of sender
> 
[snip]
> 
> So, does Juha's approach offer any security benefits over simpler hacks, 
> like my source-to-authority matching requirement? If it does, then let's 
> understand those properties and see if any sort of standardization is 
> needed. If not, then let's see what properties really are useful, and 
> see if we need to document practices that exploit those properties for 
> the operator community.
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Dean Willis <[email-masked]>
Date: Tue, 19 Oct 2004 16:44:36 -0500

>progression of sip-identity-03.
Ahah! No, this has NOTHING to do with impeding the Identity draft, as 
far as I know. But it is a suggestion of another mechanism that MIGHT be 
useful to talk about. As far as I know, it NEVER had anything to do with 
the identity draft, but was a suggestion of another technique that might 
also be useful, and deployable in the nearer term. I think we've roughly 
concluded that the specific idea suggested has little or no benefit over 
a simpler operatioal procedure, but the exercise of that analysis is 
probably something useful for the larger community.

>impede the standardization of a system that seems to satisfy the broader

Me neither.

>against certificates so far.
Yes, but this thread SUGGESTED operational policies that, in the absence 
of universal certificate deployment, might cut down on sip-spam.

>solutions will not get us where we need to be.
Operational procedures can be put in place in the "near end", (the 
domain individual operators are operating and protecting), and 
certificates gain little utility until they happen to be widely deployed 
at the FAR end, over which said operator has little control. That being 
said, there

--
Dean

---

From: Mauricio Arango <[email-masked]>
Date: Wed, 20 Oct 2004 22:18:09 -0400

Folks,

I believe the approach described in draft-ietf-sip-identity-03,
based on secure exchange of authentication assurances, is the right
way to achieve end-to-end authentication among SIP entities that
don't belong to the same administrative domain.

However, I'd like to ask of why not use an already
standardized structure, specifically SAML, for the
proposed Identity header? Something similar has been
already put forward in draft-tschofenig-sip-saml, where the
'Network Asserted Identities' case in Figure 3  is
the closest to the approach in draft-ietf-sip-identity-03
(where the SAML Asserting party role is handled by
the SIP Autentication proxy).

Benefits of using SAML include:

    - Standardized and widely adopted structure for
      security (authentication, authorization, attribute) assertions.

    - Simplifies integration with other identity management systems.

    - Extensible, XML-based format - SIP-specific message information
        including headers (eg. Contact, Call-ID, CSeq)
        and the SDP body can be specified as new SAML
        attributes.

    - Transfer of attributes associated with the asserted
        identity, which enables trait-based authorization as
        described in draft-ietf-sipping-trait-authz-00.

Regards,

Mauricio Arango

---

From: "Juha Heinanen" <[email-masked]>
Date: Thu, 21 Oct 2004 13:58:20 +0300 (EEST)

Dean Willis said:

> also be useful, and deployable in the nearer term.

that is correct, but if it is so that the identity draft requires presence
of a proxy, then it needs to be fixed so that it also works in a pure
peer-to-peer environment like the mechanism that i proposed for spam
control.

-- juha