Subject: [Sip] Comments on draft-audet-sip-sips-guidelines

From: "Michael Hammer \(mhammer\)" <[email-masked]>
Date: Wed, 28 Jun 2006 11:05:04 -0400

Samir,

Read through the draft and had a few nits and comments.

Nits: 

Sec 3, 2) "need to use" -> MUST use? 

page 4, top: "renegotiate"

Will need UAC, Proxy, UAS sections in future draft.

Comments:

Option tag: e2e-ciphersuite: Include description of semantic for
Supported header as well. When text is expanded these could be separate
sub-sections.

Suggestion: q-value should order the suites both by strength of
algorithm/key size (first) and then by preference (second). Reason is to
see degree of downgrade.

Via header should describe action that a proxy node MUST verify that the
Via header added by the previous hop is valid, i.e. that it did in fact
use the cipher named in the Via for the incoming link. May want to send
a report directly back to the UAC Contact notifying of the compromise.

Not sure error code sent back would help.

Not sure how this would work with IPSEC. The applications may not have
as much control of the host or communication with it (cross-layer
indicators). I could see the IPSEC cipher listed as a substitute. But,
then the application needs to have a means to know if it is equivalent,
unless it names those up front in the new header. For fairly well known
systems (e.g. follows the ANSI Generic Security standard), this might be
a managable list.

Does IANA already have a registry of the exact string names used for
each ciphersuite?

Last half of second paragraph above Sec 4 should be in Sec 5 security
considerations. Should also point out that this may not prevent a proxy
from dropping out Security-Level header. Thought, should the cipher also
be included in the Record-Route header? The UAC should approve the route
set for continuing the call?

The draft is a good start. Thanks for taking the ball and running with
it.

Mike

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Samir Srivastava" <[email-masked]>
Date: Fri, 30 Jun 2006 10:38:22 -0500

Hi Mike,
 
     My answers below. IMHO, it's an important piece of work. Now we
have much cleaner solution with Proxy-Require instead of
mess of SIPS etc. 
 
I remember in wacky thread  Paul Kyzivat mentioning that if SIPS etc so
bad, why not we define a new clean
solution. I request his comments on this approach. Hoping that Dave Oran
who raised the question and Paul listening.
 
Thx
Samir

________________________________

From: Michael Hammer (mhammer) [mailto:[email-masked]] 
Sent: Wednesday, June 28, 2006 8:05 AM
To: [email-masked]
Subject: [Sip] Comments on draft-audet-sip-sips-guidelines

Samir,

Nits: 

Comments:

SS>> Will fix in the next version. 

SS>> Will fix in the next version. 

SS>> It's still an OPEN ISSUE. I need to consult IPSEC experts, on how
difficult it is for application to get the info/control ? 

SS>> Will have more details on this, in the next version.

SS>> Good Catch. Will have discussions on this in the next version.

Mike