Subject: RE: [Sip] SIP Security mechanism?

From: "Fries, Steffen" <[email-masked]>
Date: Thu, 20 Jul 2006 08:04:25 +0200

Hi,

there have been discussions about reusing a symmetric key for S/MIME in
the SIPPING area a while ago. The draft is meanwhile expired but maybe
interesting for this. Ist draft-ono-sipping-smime-keyreuse-01.txt  

Ciao
	Steffen

> -----Original Message-----
> From: Hannes Tschofenig [mailto:[email-masked]] 
> Sent: Wednesday, July 19, 2006 11:03 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: [Sip] SIP Security mechanism?
> 
> Hi,
> 
> it is true that the recent security work in SIP focused on 
> media security.
> 
> Some of the proposed mechanisms could also provide security 
> for SIP signaling if signaling messages are exchanged between 
> the end points (after the initial exchange via proxies that 
> carries, for example, a finger print attribute).
> 
> Ciao
> Hannes
> 
> 
> [email-masked] wrote:
> > The idea is the general concept of doing some kind of key exchange 
> > between the UAs prior to doing signaling.  This would address the 
> > problem of maintaining the public key infrastructure.
> > 
> > If that particular algorithm and key set does not work, 
> perhaps some 
> > algoritm that had the "UAS" generate an asymmetric public key 
> > dynamically would work.  The key exchange could be for each 
> endpoint 
> > to have the other endpoint generate an asymmetric key?  I'm not a 
> > crypto person but this seems like it might be doable, does 
> any crypto 
> > person here know of how that could be done?
> > 
> > 
> > FM
> > 
> > 
> > 
> > ------------------------------------------------ On Wed, 19 Jul 2006
> > 21:37:47 +0200, Hannes Tschofenig <[email-masked]> wrote:
> > 
> > 
> >> If you run a DH then the outcome is a symmetric key. 
> S/MIME does not 
> >> work with symmetric keys.
> >> 
> >> Ciao Hannes
> >> 
> >> [email-masked] wrote:
> >> 
> >>> I've been reading about the ZRTP lately.  I read 
> Henning's comment 
> >>> at the IETF meeting about how S/MIME relies on the 
> receiver's public 
> >>> key to be available to allow for encryption/decryption to work.
> >>> 
> >>> Why couldnt we put in place a mechanism that did a key 
> exchange for 
> >>> SIP signaling similar to whats done in ZRTP (i.e. modified
> >>> Diffie-Hellman) prior to any signaling traffic, then use the 
> >>> exchanged keys as the basis for S/MIME encryption of the bodies?
> >>> Or we could even get really carried away and use it to do 
> encryption 
> >>> of the entire SIP message if the signaling did not 
> traverse proxies? 
> >>> This could be useful for encrypting UDP signaling, again 
> if no proxy 
> >>> were involved.
> >>> 
> >>> Thoughts? FM
> >>> 
> >>> 
> >>> _______________________________________________ Sip mailing list 
> >>> https://www1.ietf.org/mailman/listinfo/sip This list is for NEW 
> >>> development of the core SIP Protocol Use 
> >>> [email-masked] for questions on current 
> sip Use  
> >>> [email-masked] for new developments on the application of sip
> >>> 
> >>> 
> >> 
> > 
> > 
> 
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol Use 
> [email-masked] for questions on current sip 
> Use [email-masked] for new developments on the application of sip
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip