Subject: RE: [Sip] Issue 4 in draft-ietf-sip-connected-identity-00.txt

From: "Elwell, John" <[email-masked]>
Date: Sun, 09 Jul 2006 17:53:09 +0100

Dan,

Yes, I agree with your motivation for being able to have signed SDP in the
reverse direction. This doesn't necessarily mean UPDATE has to be used -
re-INVITE would do, but I prefer to use UPDATE unless there are other
reasons for using re-INVITE.

The question is whether we should mandate including an SDP offer in the
UPDATE so that we always have the benefit of this signature.

John 

> -----Original Message-----
> From: Dan Wing [mailto:[email-masked]] 
> Sent: 08 July 2006 02:21
> To: Elwell, John; [email-masked]
> Subject: RE: [Sip] Issue 4 in draft-ietf-sip-connected-identity-00.txt
> 
> > -----Original Message-----
> > From: Elwell, John [mailto:[email-masked]] 
> > Sent: Tuesday, May 02, 2006 1:24 PM
> > To: [email-masked]
> > Subject: [Sip] Issue 4 in draft-ietf-sip-connected-identity-00.txt
> > 
> > The fourth issue is not actually in draft-00 but was raised
> > subsequently.  If a UA supports a change of From header field URI
> > mid-dialog, as indicated by the "id-change" option tag, we could
> > mandate that it also support the SIP UPDATE method.  Then the peer
> > UA in a dialog would be free to use the UPDATE method to report
> > connected identity, rather than the less suitable re-INVITE method.
> > The use of UPDATE means 2 messages instead of 3 and avoids the need
> > for an offer-answer exchange.  I heard no objections when this was
> > proposed a few days ago.  Do we have consensus?
> 
> I prefer UPDATE.  I am considering the needs of some proposed 
> SRTP keying techniques which could benefit from strong authentication
> of identity and of the fingerprints or certificates in SDP.  For
> those cases it's helpful to include SDP in the UPDATE so that it
> gets signed with Identity, even if that SDP is exactly the same as
> the SDP in the answer.  An example of where Identity could help is 
> with a pure DH mode (such as draft-baugher-mmusic-sdp-dh).  It can 
> also help provide additional protection of a UA's self-signed 
> certificate (various MIKEY modes) or certificate fingerprint 
> (mmusic-comedia-tls, mcgrew-tls-srtp).  
> 
> Even without SRTP and without comedia-tls, the reasons that 
> Identity chose to include the offerer's SDP in its signature 
> should be applicable to the answerer's SDP.  Otherwise we're
> saying the answerer's SDP doesn't need authentication or
> integrity protection.
> 
> -d
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Dan Wing" <[email-masked]>
Date: Sun, 9 Jul 2006 21:04:45 -0400

> Yes, I agree with your motivation for being able to have 
> signed SDP in the reverse direction. This doesn't necessarily mean 
> UPDATE has to be used - re-INVITE would do, but I prefer to use 
> UPDATE unless there are other reasons for using re-INVITE.
> 
> The question is whether we should mandate including an SDP 
> offer in the UPDATE so that we always have the benefit of 
> this signature.

Agreed.

And if the SDP is exactly the same, I see a lot of value and little harm.

-d