Subject: [Sip] I-D Action:draft-ietf-sip-certs-05.txt

From: [email-masked]
Date: Fri, 1 Feb 2008 12:45:02 -0800 (PST)

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Session Initiation Protocol Working Group of the IETF.

	Title           : Certificate Management Service for The Session Initiation Protocol (SIP)
	Author(s)       : C. Jennings, et al.
	Filename        : draft-ietf-sip-certs-05.txt
	Pages           : 30
	Date            : 2008-02-01

This draft defines a Credential Service that allows Session
Initiation Protocol (SIP) User Agents (UAs) to use a SIP event 
package to discover the certificates of other users.  This mechanism 
allows user agents that want to contact a given Address-of-Record 
(AOR) to retrieve that AOR's certificate by subscribing to the
Credential Service, which returns an authenticated response 
containing that certificate.  The Credential Service also allows 
users to store and retrieve their own certificates and private keys.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-sip-certs-05.txt

To remove yourself from the I-D Announcement list, send a message to
[email-masked] with the word unsubscribe in the body of 
the message.
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the 
username "anonymous" and a password of your e-mail address. After 
logging in, type "cd internet-drafts" and then
	"get draft-ietf-sip-certs-05.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-ietf-sip-certs-05.txt".

NOTE:   The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
_______________________________________________
Sip mailing list  http://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Dean Willis <[email-masked]>
Date: Sun, 3 Feb 2008 10:38:50 -0600

> 	Filename        : draft-ietf-sip-certs-05.txt

I've requested publication for this draft.

Here's the writeup I submitted along with the pub request, should you  
be interested.

----------------

The SIP working group hereby requests publication of the document  
draft-ietf-sip-certs-05 as a Proposed Standard.

    (1.a)  Who is the Document Shepherd for this document?  Has the
           Document Shepherd personally reviewed this version of the
           document and, in particular, does he or she believe this
           version is ready for forwarding to the IESG for publication?

The Document Shepherd is working group chair Dean Willis, who has  
personally reviewed this version of the document and believes it is  
ready for forwarding to the IESG for publication.

    (1.b)  Has the document had adequate review both from key WG members
           and from key non-WG members?  Does the Document Shepherd have
           any concerns about the depth or breadth of the reviews that
           have been performed?

The document has been extensively reviewed within the working group  
and by external reviewers, including security area review.

    (1.c)  Does the Document Shepherd have concerns that the document
           needs more review from a particular or broader perspective,
           e.g., security, operational complexity, someone familiar with
           AAA, internationalization or XML?

No further review required.

    (1.d)  Does the Document Shepherd have any specific concerns or
           issues with this document that the Responsible Area Director
           and/or the IESG should be aware of?  For example, perhaps he
           or she is uncomfortable with certain parts of the  
document, or
           has concerns whether there really is a need for it.  In any
           event, if the WG has discussed those issues and has indicated
           that it still wishes to advance the document, detail those
           concerns here.  Has an IPR disclosure related to this  
document
           been filed?  If so, please include a reference to the
           disclosure and summarize the WG discussion and conclusion on
           this issue.

No concerns.

    (1.e)  How solid is the WG consensus behind this document?  Does it
           represent the strong concurrence of a few individuals, with
           others being silent, or does the WG as a whole understand and
           agree with it?

This document enjoys a high level of working group concurrence,  
relative to the majority of security-related documents. Essentially  
the working group as a whole agree with the document, including the  
ones who actually understand it.

    (1.f)  Has anyone threatened an appeal or otherwise indicated  
extreme
           discontent?  If so, please summarise the areas of conflict in
           separate email messages to the Responsible Area Director.   
(It
           should be in a separate email because this questionnaire is
           entered into the ID Tracker.)

This shepherd is unaware of any discontent.

    (1.g)  Has the Document Shepherd personally verified that the
           document satisfies all ID nits?  (See
           http://www.ietf.org/ID-Checklist.html and
           http://tools.ietf.org/tools/idnits/).  Boilerplate checks are
           not enough; this check needs to be thorough.  Has the  
document
           met all formal review criteria it needs to, such as the MIB
           Doctor, media type and URI type reviews?

The shepherd applied idnits 2.06.01. Note that the document does  
contain a downref to RFC 2898. This downref is explained in the  
references section of the document and appears to be justified under  
the procedures of RFC 3967. The following text is quoted from the  
document:

               This reference is normative.  The mechanisms used in this
               specification from RFC2898 are stable and sutable for use
               in a standards track specification.  RFC2898 has been  
used
               as a normative reference in several prior standards track
               documents including RFC3185, RFC3370, RFC3962, and
               RFC4656.

The document also received appropriate review from the MIME Types  
alias and SIP events alias.

    (1.h)  Has the document split its references into normative and
           informative?  Are there normative references to documents  
that
           are not ready for advancement or are otherwise in an unclear
           state?  If such normative references exist, what is the
           strategy for their completion?  Are there normative  
references
           that are downward references, as described in [RFC3967]?  If
           so, list these downward references to support the Area
           Director in the Last Call procedure for them [RFC3967].

References are properly split, with one valid downward reference as  
described above.

    (1.i)  Has the Document Shepherd verified that the document IANA
           consideration section exists and is consistent with the body
           of the document?  If the document specifies protocol
           extensions, are reservations requested in appropriate IANA
           registries?  Are the IANA registries clearly identified?  If
           the document creates a new registry, does it define the
           proposed initial contents of the registry and an allocation
           procedure for future registrations?  Does it suggest a
           reasonable name for the new registry?  See [RFC2434].  If the
           document describes an Expert Review process has Shepherd
           conferred with the Responsible Area Director so that the IESG
           can appoint the needed Expert during the IESG Evaluation?

The IANA actions section appears to be correct, and has undergone  
appropriate expert review.

    (1.j)  Has the Document Shepherd verified that sections of the
           document that are written in a formal language, such as XML
           code, BNF rules, MIB definitions, etc., validate correctly in
           an automated checker?

The document appears to contain no formal language.

    (1.k)  The IESG approval announcement includes a Document
           Announcement Write-Up.  Please provide such a Document
           Announcement Write-Up?  Recent examples can be found in the
           "Action" announcements for approved documents.  The approval
           announcement contains the following sections:

           Technical Summary

This draft defines a Credential Service that allows Session  
Initiation Protocol (SIP) User Agents (UAs) to use a SIP event  
package to discover the certificates of other users.  This mechanism  
allows user agents that want to contact a given Address-of-Record  
(AOR) to retrieve that AOR's certificate by subscribing to the  
Credential Service, which returns an authenticated response  
containing that certificate.  The Credential Service also allows  
users to store and retrieve their own certificates and private keys.  
Several operational modes are defined, wherein the credential service  
may act only as a distributor of the public key, may also act as a  
distributor of the encrypted private key, or as the repository and  
distributor of both the public and private key.

           Working Group Summary

The working group process for this draft was unusually long, spanning  
several years.

           Document Quality
              Are there existing implementations of the protocol?   
Have a
              significant number of vendors indicated their plan to
              implement the specification?  Are there any reviewers that
              merit special mention as having done a thorough review,
              e.g., one that resulted in important changes or a
              conclusion that the document had no substantive  
issues?  If
              there was a MIB Doctor, Media Type or other expert review,
              what was its course (briefly)?  In the case of a Media  
Type
              review, on what date was the request posted?

We are currently not aware of any publicly announced implementations  
of this specification, although one can be built relatively trivially  
on top of general purpose SIP Events servers, and we are aware of at  
least one internal prototype implemented in this manner.

MIME type review was non-controversial and was initiated on March 12,  
2007. Björn Höhrmann raised several points, which were resolved in  
the -04 version of this specification.

SIP Events review was performed by Adam Roach, with several issues  
being noted and resolved in -03 of this specification.
_______________________________________________
Sip mailing list  http://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jerry Yin <[email-masked]>
Date: Tue, 5 Feb 2008 13:23:53 -0800 (PST)

Hi Rohan and all,
   
  I can't find the discussing about the connection reuse when NAT/Firewall involved. Sorry if it is documented somewhere already. Here's my comments:

   SIP UA behind a NAT/Firewall using TCP: According to the current draft (08), the UA and proxy have to create bi-direction connections. It seems that it is impossible for the proxy (at the public side of the firewall) to make a new TCP connection to the phone for incoming requests without reusing the phone’s existing TCP connection with the proxy.  
   SIP UA behind a NAT using TCP to register to the server: The only possible way a UA can receive incoming calls is to reuse the TCP connection that it has created to register with the proxy/registrar.
   
  For the above two reasons, I think it would be better to treat the TCP/SCTP the same way as the TLS. It would make the design and implementation simple. The SIP routing behavior would be consistent when supporting the “connection reuse” draft.
   
  As the TCP security concerns are discussed in the section 9.3 “Security Considerations for the TCP Transport”, the first 3 attacks can be prevented by Digest authentications. I can’t figure out what is the last case all about (Proxy enter an aliasing agreement with downstream proxy)?  If there are services between these two proxies, they will create connections, one or two, anyway. What are really the concerns here?
   
  Regards,
  Jerry

---------------------------------
Never miss a thing.   Make Yahoo your homepage.

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Tue, 05 Feb 2008 15:41:44 -0600

> Hi Rohan and all,

Jerry: Thank you for your time reviewing the draft.

> I can't find the discussing about the connection reuse when NAT/Firewall 
> involved. Sorry if it is documented somewhere already. 

That particular behavior is documented in sip-outbound
(see Section 2 of connect-reuse for a reference to the discussion
delineating connect-reuse and sip-outbound.)  sip-outbound can be
accessed from: http://tools.ietf.org/html/draft-ietf-sip-outbound-11

> For the above two reasons, I think it would be better to treat the 
> TCP/SCTP the same way as the TLS. It would make the design and 
> implementation simple. The SIP routing behavior would be consistent when 
> supporting the “connection reuse” draft.
>  
> As the TCP security concerns are discussed in the section 9.3 “*Security 
> Considerations for the TCP Transport”, *the first 3 attacks can be 
> prevented by Digest authentications. I can’t figure out what is the last 
> case all about (Proxy enter an aliasing agreement with downstream 
> proxy)?  If there are services between these two proxies, they will 
> create connections, one or two, anyway. What are really the concerns here?

As it turns out, we are about to release -09 based on the WGLC review
in November.  Brett and I are trying to close an open issue between
us, and once that is done, -09 will be released later this week.
-09 provides more succinct reasons why TCP/SCTP cannot be reused and
it also shortens considerably Section 9.3 based on the WGLC review
feedback.

Thanks,

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
2701 Lucent Lane, Rm. 9F-546, Lisle, Illinois 60532 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
WWW:   http://www.alcatel-lucent.com/bell-labs
_______________________________________________
Sip mailing list  http://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jerry Yin <[email-masked]>
Date: Wed, 6 Feb 2008 07:21:46 -0800 (PST)

[Jerry Yin] Hi Vijay, thanks for the response. The outbound draft is exactly reuse the client started connection as I indicated in the previous mail. It seems there's an inconsistency between these two drafts.

  
[Jerry Yin] Looking forward to read your new draft.
  thanks, 
  Jerry

Thanks,

- vijay

---

From: "Brett Tate" <[email-masked]>
Date: Wed, 6 Feb 2008 11:55:56 -0500

Hi Jerry,
 
Please read the section 2.  The NAT/Firewall issues are not to be solved
by the reuse draft.
 
Thanks,
Brett

________________________________

	From: Jerry Yin [mailto:[email-masked]] 
	Sent: Wednesday, February 06, 2008 10:22 AM
	To: Vijay K. Gurbani
	Cc: IETF SIP List; [email-masked]; Brett Tate;
[email-masked]
	Subject: Re: Comments on draft-ietf-sip-connect-reuse-08

	"Vijay K. Gurbani" <[email-masked]> wrote: 

		

		That particular behavior is documented in sip-outbound
		(see Section 2 of connect-reuse for a reference to the
discussion
		delineating connect-reuse and sip-outbound.)
sip-outbound can be
		accessed from:
http://tools.ietf.org/html/draft-ietf-sip-outbound-11

		[Jerry Yin] Hi Vijay, thanks for the response. The
outbound draft is exactly reuse the client started connection as I
indicated in the previous mail. It seems there's an inconsistency
between these two drafts.