Subject: Re: [Sip] Updated acr-code draft

From: Dean Willis <[email-masked]>
Date: Mon, 31 Jul 2006 13:02:06 -0500

On Jun 21, 2006, at 1:11 AM, Jeroen van Bemmel wrote:

> Jonathan,
>
> (Only) one comment: What about privacy service behavior? In  
> particular I am
> thinking about a privacy service that anonymized the request, and  
> receives a
> 433.
>
> If the privacy service is acting as a B2BUA, it should probably not  
> retry
> the request "non-anonymously" (this could constitute a downgrade  
> attack).
> This is also something worth mentioning in the security  
> considerations: the
> retrying of the request SHOULD be based on an explicit decision by  
> the user
> making the request, it SHOULD NOT be done automatically

Any response on this before we move to last call?

--
Dean

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 31 Jul 2006 16:17:51 -0400

I think it can retry automatically if it was at the request of the user 
to do so. So, I agree with 'explicitly' but that doesn't rule out 
'automatically'. I'll clarify in the security considerations section.

Thanks,
Jonathan R.

Jeroen van Bemmel wrote:

> Jonathan,
> 
> (Only) one comment: What about privacy service behavior? In particular I am
> If the privacy service is acting as a B2BUA, it should probably not retry
> the request "non-anonymously" (this could constitute a downgrade attack).
> This is also something worth mentioning in the security considerations: the
> retrying of the request SHOULD be based on an explicit decision by the user
> Regards,
> Jeroen
> ----- Original Message ----- From: "Jonathan Rosenberg" <[email-masked]>
> To: "IETF SIP List" <[email-masked]>
> Sent: Tuesday, June 20, 2006 4:42 AM
> Subject: [Sip] Updated acr-code draft
> 
> 
>> I've just submitted a minor update to the ACR code draft. Until it 
>> appears, you can pick it up at:
>>
>> http://www.jdrosen.net/papers/draft-ietf-sip-acr-code-01.txt
>>
>> The changes were to add the required RFC 2119 boilerplate and fix some 
>> spell check errors. The document is complete AFAIK and has had no 
>> discussion since the last revision. I believe it ready for WGLC.
>>
>> -Jonathan R.
>> -- 
>> Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
>> Cisco Fellow                                   Parsippany, NJ 07054-2711
>> Cisco Systems
>> [email-masked]                              FAX:   (973) 952-5050
>> http://www.jdrosen.net                         PHONE: (973) 952-5000
>> http://www.cisco.com
>>

-- 
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Cisco Fellow                                   Parsippany, NJ 07054-2711
Cisco Systems
[email-masked]                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com