Subject: Re: [Sip] draft-ietf-sip-certs-00, communicating private keys and self-signed certificates

From: "Jason Fischl" <[email-masked]>
Date: Mon, 10 Jul 2006 11:10:36 -0400

On 6/30/06, Cullen Jennings <[email-masked]> wrote:
>
> On Jun 26, 2006, at 1:00 PM, Jeroen van Bemmel wrote:
>
>
> On the using a GRUU in a cert, would need to consider that any time
> my GRUU changes I need to generate a new cert - if this meant a new
> private/public key pair, this might be expensive.
>

Also consider that GRUUs will change relatively frequently for devices.

Can I get a sense on the list of who thinks storing the GRUU instead
of the AOR in the cert is worth additional consideration in the
context of this document? I would suggest leaving this out of scope
for now.

Jason

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Michael Thomas <[email-masked]>
Date: Mon, 10 Jul 2006 08:35:22 -0700

>> private/public key pair, this might be expensive.

Just piggybacking on this comment. First, try doing an openssl genrsa --
it doesn't take very long to create a new key pair for all but really large
keys. Second, I don't understand why one would need to create new keys
for new identities. A certificate is nothing more than a name/key binding
at its heart. There's nothing in the certificate that can sniff out 
whether the
key is fresh or stale, and in the abstract there's nothing wrong with having
a single key signing for a variety of different identities (*).

       Mike

[*] context matters here, of course, but my guess is that for the average UA
      it matters very little.

---

From: [email-masked]
Date: Tue, 11 Jul 2006 13:36:10 -0400

From: "Jason Fischl" <[email-masked]>

Why would GRUUs change "relatively frequently"?  They can change only
as frequently as the AOR changes, or the instance-id changes.

Dale

---

From: "Jason Fischl" <[email-masked]>
Date: Wed, 12 Jul 2006 08:49:05 -0400

> as frequently as the AOR changes, or the instance-id changes.

Yes. I was just confused. Sorry about that and thanks for pointing it out.

---

From: Dean Willis <[email-masked]>
Date: Wed, 12 Jul 2006 10:26:16 -0500

> Yes. I was just confused. Sorry about that and thanks for pointing  

In practice, I would not be surprised if they actually change more  
frequently -- either with reboot of the assigning server, or perhaps  
on a database rebuild, major upgrade, etc. I'm not aware of anybody  
currently adding assigned GRUUs to their "long term provisioning  
database of record", which is what would be needed to maintain the  
GRUU as long as we might want.

--
Dean

---

From: [email-masked]
Date: Wed, 12 Jul 2006 20:50:18 -0400

From: Dean Willis <[email-masked]>

sipX (http://www.sipfoundry.org) constructs GRUUs by hashing the AOR,
instance ID, and a fixed key string.  So its GRUUs really are eternal.

Dale