Subject: RE: [Sip] RE: Question to Identity draft

From: "Peterson, Jon" <[email-masked]>
Date: Wed, 20 Apr 2005 16:34:20 -0400

> On Tue, 2005-04-19 at 13:30, Cullen Jennings wrote:
> > You can't use a certificate for a
> > user, like [email-masked] to assert identity using the identity draft
> > mechanism. 
> 
> That strikes me as a bug rather than a feature. What if I
> have outsourced functions where I only want to delegate
> a certain subset of sip URI's to them? Oh say, like 
> [email-masked] that's really some other company?
> That is, I want them to be able to assert [email-masked],
> but nothing else. Or suppose that [email-masked] is the
> CEO and she wants to be able to call from her device on the
> road when she's not behind the example.com corporate 
> proxies? Why can't she just sign the identity herself...
> she's the CEO, right?
 
If you had a certificate for sip:[email-masked], you could use the existing RFC3261 procedures to leverage that cert for integrity, confidentiality, and what have you. sip-identity is largely a workaround for the non-existence of such certs, which in turn is a result of the huge problems with enrollment in and administration of a PKI for such certs.

Jon Peterson
NeuStar, Inc.

> 		Mike

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Michael Thomas <[email-masked]>
Date: Wed, 20 Apr 2005 15:15:57 -0700

> If you had a certificate for sip:[email-masked], you could use the existing RFC3261 procedures to leverage that cert for integrity, confidentiality, and what have you. sip-identity is largely a wor…

These really aren't the same problem spaces. SMIME is
trying to deal with end-end identity, integrity and
confidentiality. That is a much larger -- and different -- 
problem set than "domain" level identity, integrity
and *authorization*. 

So no, I don't think it's reasonable to partition the
problems this way; they both have their distinct uses.

		Mike