Subject: [Sip] AUTH48 suggested changes for draft-ietf-sip-identity-06

From: Fredrik Thulin <[email-masked]>
Date: Wed, 21 Jun 2006 21:11:27 +0200

Hi

The following are the parts of my longer mail about draft-sip-identity
(http://www1.ietf.org/mail-archive/web/sip/current/msg14841.html) that I 
think (or hope) can actually be addressed during AUTH48 :

>4.  Overview of Operations
>...
>and thus can validates that the domain indicated

nit: should be "can validate"

>5.  Authentication Service Behavior
>...
>                                             Note that if that proxy
>    server is maintaining a TLS connection with the client over which
>    the client had previously authenticated itself using Digest
>    authentication, the identity value obtained from that previous
>    authentication step can be reused without an additional Digest
>    challenge.

Remove this part about a possibility to avoid authenticating a user more 
than once per TLS session. The proxy server can't know that it is only 
a single UA that can send messages to it using a given TLS session 
unless the UA has identified itself with a client certificate, so this 
is, IMO, bad advice security-wise.

>    If the authentication service is instantiated by a SIP user agent,
>    a user agent can be said to authenticate its user on the grounds
>    that the user can provision the user agent with the private key of
>    the domain, or preferably by providing a password that unlocks
>    said private key

I'm sure this is not what is intended, but this almost sound as if you 
think it is perfectly normal to make the private key available publicly 
as long as it is protected by a password. That might be true if the 
password is _stronger_ than the private key, but passwords typically 
aren't. I propose that you remove the last part (", or 
preferably ...").

>9.  Header Syntax
>...
>the first letter of each week and month MUST be capitalized

nit: should be weekday I believe

>13.2.  Display Names and Identity
>...
>SIP accounts with arbitrarily display-names.

nit: I'm not a native english speaker, but I believe it should be 
"arbitrary".

/Fredrik

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Peterson, Jon" <[email-masked]>
Date: Thu, 22 Jun 2006 15:23:58 -0400

> is, IMO, bad advice security-wise.

In the absence of a direct TLS connection between the UA and the authentication service, the whole sip-identity mechanism becomes less secure for a number of reasons - you raise one. The sentence above was intended to apply only to cases where such a direct connection exists, but I see how it could be read otherwise. I will fix that. Moreover, I think it is possible for the authentication service to determine whether or not a direct connection has been established in the absence of a client certificate, though I'm not sure that I want to specify that in this draft, necessarily.

> aren't. I propose that you remove the last part (", or 

There is certainly no connotation whatsoever here of making a private key available publicly. The text describes how a user provisions a user agent with a private key so that a user agent can instantiate the authentication service role. For cases where a user agent serves multiple users, it is sensible to password-protect these private keys so that the user agent can "authenticate" its user. That much said, I can try to reword it a bit, since it does scan a little awkwardly.

Jon Peterson
NeuStar, Inc.