Subject: Re: [Sip] draft-dotson-sip-mutual-auth-02

From: "DRAGE, Keith \(Keith\)" <[email-masked]>
Date: Wed, 4 Jun 2008 11:48:23 +0200

(As SIP WG cochair)

This has been raised in the SIP group a couple of times, and we have not
yet gained an idea of whether to proceed with it in the SIP WG or not.
 
There have been a couple of technical comments raised in the past from
the security experts; my understanding is that these have now been
clarified.
 
I believe in the past there has been an interested community that says
this is useful. It has also been clarified that 3GPP would like to use
it in their specifications.
 
So could I ask the WG to look at this document, and formally to indicate
whether they believe some work with this scope should be progressed as a
SIP WG item.
 
http://www.ietf.org/internet-drafts/draft-dotson-sip-mutual-auth-02.txt

So if you support it please indicate to the SIP WG chairs.

If you have technical concerns (i.e. it should not proceed because it is
technically flawed beyond fixing) then please ideally mail the list,
although the SIP WG chairs will also accept input.

Responses please in 1 calendar week from this date.

Regards

Keith

________________________________

	From: [email-masked] [mailto:[email-masked]] On
Behalf Of Stuart Hoggan
	Sent: Friday, May 02, 2008 5:15 PM
	To: [email-masked]
	Subject: [Sip] draft-dotson-sip-mutual-auth-02

	Folks,

	Based on the feedback received in Philadelphia, we have updated
draft-dotson-sip-mutual-auth. The changes clarify the usage of the
Proxy-Authentication-Info header, including support for multiple values.

	Any further comments or suggestions will be appreciated. It
would also be nice to obtain WG feedback on pursuing this I-D as a WG
document.

	Regards,

	Stuart

_______________________________________________
Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Francois Audet" <[email-masked]>
Date: Wed, 4 Jun 2008 13:07:39 -0500

I do not believe that this document provide enought 
justification of what is the problem that is being attempted to
be solved, and why it isn't already solved by existing mechanism
that are widely implemented (such as TLS).

Section 9 (Security Considerations) I believe touches on it
a little bit, but it seems both incomplete and out of place.

The problem statement needs to be brough forward in the document
(say to section 3 or a new section). The scope of applicability
of the solution should also be described up-front).

I wan't to clarfiy I'm not necessarily against this: I just want
the justification to be clearer. The onus should be on this
document to clearly demonstrate why what we currently have
is broken.

> -----Original Message-----
> Behalf Of DRAGE, Keith (Keith)
> Sent: Wednesday, June 04, 2008 02:48
> To: [email-masked]
> Subject: Re: [Sip] draft-dotson-sip-mutual-auth-02
> 
> (As SIP WG cochair)
> 
> This has been raised in the SIP group a couple of times, and 
> we have not yet gained an idea of whether to proceed with it 
> in the SIP WG or not.
>  
> There have been a couple of technical comments raised in the 
> past from the security experts; my understanding is that 
> these have now been clarified.
>  
> I believe in the past there has been an interested community 
> that says this is useful. It has also been clarified that 
> 3GPP would like to use it in their specifications.
>  
> So could I ask the WG to look at this document, and formally 
> to indicate whether they believe some work with this scope 
> should be progressed as a SIP WG item.
>  
> If you have technical concerns (i.e. it should not proceed 
> because it is technically flawed beyond fixing) then please 
> ideally mail the list, although the SIP WG chairs will also 
> accept input.
> 
> 	From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Stuart Hoggan
> 	Based on the feedback received in Philadelphia, we have 
> updated draft-dotson-sip-mutual-auth. The changes clarify the 
> usage of the Proxy-Authentication-Info header, including 
> support for multiple values.
> 
> 
> 	 
> 
> 	Any further comments or suggestions will be 
> appreciated. It would also be nice to obtain WG feedback on 
> pursuing this I-D as a WG document.
> 
> 	 
> 
> 	Regards,
> 
> 	Stuart
> 
> 	 
> 
> This list is for NEW development of the core SIP Protocol Use 
> [email-masked] for questions on current sip

---

From: "Sumanth Channabasappa" <[email-masked]>
Date: Wed, 4 Jun 2008 12:33:26 -0600

Francois,

Thanks for your thoughts. We can certainly add more details if it is
unclear. 

As a clarification, I don't think we are saying that the current
mechanism is necessarily broken (which is why it is not an essential
correction, as discussed earlier in the WG). However, we want to allow
for the use of this header in deployments that use Digest (with or
without TLS; e.g., when integrity protection is provided by other means)
and can benefit from its advantages (mutual auth, nextnonce). 

- S

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Francois Audet
Sent: Wednesday, June 04, 2008 12:08 PM
To: DRAGE, Keith (Keith); [email-masked]
Subject: Re: [Sip] draft-dotson-sip-mutual-auth-02

---

From: "Francois Audet" <[email-masked]>
Date: Wed, 4 Jun 2008 14:01:59 -0500

Ok, thanks.

I would like the begining of the document (say section 3, or a Scope,
Applicability statement or similar section) to explains
when and why this is useful.

The purpose is really for an implementor to be able by reading this 
section to be in a position to determine if it's somthing that should
he needs to worry about or not. 

So, say if I'm developping a UA for an IMS environment versus an
Enteprise SIP UA, or an Enteprise SIP access to a service provider
network, I'll know if this applies to me or not.

Cheers. 

> From: Sumanth Channabasappa [mailto:[email-masked]] 
> Sent: Wednesday, June 04, 2008 11:33
> To: Audet, Francois (SC100:3055); DRAGE, Keith (Keith); [email-masked]
> Subject: RE: [Sip] draft-dotson-sip-mutual-auth-02
> 
> Francois,
> 
> Thanks for your thoughts. We can certainly add more details 
> if it is unclear. 
> 
> As a clarification, I don't think we are saying that the 
> current mechanism is necessarily broken (which is why it is 
> not an essential correction, as discussed earlier in the WG). 
> However, we want to allow for the use of this header in 
> deployments that use Digest (with or without TLS; e.g., when 
> integrity protection is provided by other means) and can 
> benefit from its advantages (mutual auth, nextnonce). 
> 
> - S
> 
> Behalf Of Francois Audet
> justification of what is the problem that is being attempted 
> to be solved, and why it isn't already solved by existing 
> mechanism that are widely implemented (such as TLS).
> 
> Section 9 (Security Considerations) I believe touches on it a 
> little bit, but it seems both incomplete and out of place.
> 
> The problem statement needs to be brough forward in the 
> document (say to section 3 or a new section). The scope of 
> applicability of the solution should also be described up-front).
> 
> I wan't to clarfiy I'm not necessarily against this: I just 
> want the justification to be clearer. The onus should be on 
> this document to clearly demonstrate why what we currently 
> have is broken.
> 
> > This has been raised in the SIP group a couple of times, 
> and we have 
> > not yet gained an idea of whether to proceed with it in the 
> SIP WG or 
> > not.
> >  
> > So could I ask the WG to look at this document, and formally to 
> > indicate whether they believe some work with this scope should be 
> > progressed as a SIP WG item.
> >  
> because it 
> > is technically flawed beyond fixing) then please ideally mail the 
> > list, although the SIP WG chairs will also accept input.
> > 
> appreciated. It would 
> > also be nice to obtain WG feedback on pursuing this I-D as a WG 
> > document.
> > 
> > 	 
> > 
> > 	Regards,
> > 
> > 	Stuart
> > 
> > 	 
> > 
> > [email-masked] for questions on current sip Use 
> > [email-masked] for new developments on the application of sip
> >

---

From: "Sumanth Channabasappa" <[email-masked]>
Date: Wed, 4 Jun 2008 13:42:47 -0600

Sounds fair, we can provide additional information in a revision
(probably when the WG decides to pursue this effort?).

Thanks!
- S

-----Original Message-----
From: Francois Audet [mailto:[email-masked]] 
Sent: Wednesday, June 04, 2008 1:02 PM
To: Sumanth Channabasappa; DRAGE, Keith (Keith); [email-masked]
Subject: RE: [Sip] draft-dotson-sip-mutual-auth-02

Ok, thanks.

Cheers.

---

From: "Christer Holmberg" <[email-masked]>
Date: Thu, 5 Jun 2008 08:50:14 +0200

Hi,

I think it would be good to provide a revision, with the addtional information, asap. It will be easier to make a decission whether to move the draft forward, and it will hopefully reduce the what-is-this-needed-for type of questions.

Regards,

Christer

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Sumanth Channabasappa
Sent: 4. kesäkuuta 2008 22:43
To: Francois Audet; DRAGE, Keith (Keith); [email-masked]
Subject: Re: [Sip] draft-dotson-sip-mutual-auth-02

Sounds fair, we can provide additional information in a revision (probably when the WG decides to pursue this effort?).

Thanks!
- S

-----Original Message-----
From: Francois Audet [mailto:[email-masked]]
Sent: Wednesday, June 04, 2008 1:02 PM
To: Sumanth Channabasappa; DRAGE, Keith (Keith); [email-masked]
Subject: RE: [Sip] draft-dotson-sip-mutual-auth-02

Ok, thanks.

I would like the begining of the document (say section 3, or a Scope, Applicability statement or similar section) to explains when and why this is useful.

The purpose is really for an implementor to be able by reading this section to be in a position to determine if it's somthing that should he needs to worry about or not. 

So, say if I'm developping a UA for an IMS environment versus an Enteprise SIP UA, or an Enteprise SIP access to a service provider network, I'll know if this applies to me or not.

Cheers. 

> correction, as discussed earlier in the WG).
> However, we want to allow for the use of this header in deployments 
> that use Digest (with or without TLS; e.g., when integrity protection 
> is provided by other means) and can benefit from its advantages 
> (mutual auth, nextnonce).
> 
> - S
> 
> I do not believe that this document provide enought justification of 
> what is the problem that is being attempted to be solved, and why it 
> isn't already solved by existing mechanism that are widely implemented 
> (such as TLS).
> 
> Section 9 (Security Considerations) I believe touches on it a little 
> bit, but it seems both incomplete and out of place.
> 
> The problem statement needs to be brough forward in the document (say 
> to section 3 or a new section). The scope of applicability of the 
> solution should also be described up-front).
> 
> I wan't to clarfiy I'm not necessarily against this: I just want the 
> justification to be clearer. The onus should be on this document to 
> clearly demonstrate why what we currently have is broken.
> 
This list is for NEW development of the core SIP Protocol Use [email-masked] for questions on current sip Use [email-masked] for new developments on the application of sip

---

From: "Stuart Hoggan" <[email-masked]>
Date: Tue, 10 Jun 2008 16:00:32 -0600

All,

We have updated the document to incorporate feedback received so far.
It now contains a section that helps clarify the motivation.  Let us
know if you have further comments. 

-Stuart

> DRAGE, Keith (Keith)
> Sent: Wednesday, June 04, 2008 3:48 AM
> To: [email-masked]
indicate

---

From: "Schmidt, Christian 1. (NSN - DE/Muenich)" <[email-masked]>
Date: Thu, 12 Jun 2008 15:18:29 +0200

Hi,

There is a small error in the link, it should be:
http://www.ietf.org/internet-drafts/draft-dotson-sip-mutual-auth-03.txt

It is useful and it should become SIP WG item.

Regards
Christian

-----Ursprüngliche Nachricht-----
Von: [email-masked] [mailto:[email-masked]] Im Auftrag von ext Stuart Hoggan
Gesendet: Mittwoch, 11. Juni 2008 00:01
An: DRAGE, Keith (Keith); [email-masked]
Betreff: Re: [Sip] draft-dotson-sip-mutual-auth-02

All,

-Stuart

indicate

---

From: "DRAGE, Keith \(Keith\)" <[email-masked]>
Date: Thu, 12 Jun 2008 15:50:15 +0200

(As SIP WG cochair)

The document has now been updated based on comments received.

I will give a few more days for responses to the question of support /
no support.

Please read the draft and indicate your postion.

Regards

Keith 

> From: Stuart Hoggan [mailto:[email-masked]] 
> Sent: Tuesday, June 10, 2008 11:01 PM
> It now contains a section that helps clarify the motivation.  
> Let us know if you have further comments. 
> 
> -Stuart
> 
> > whether they believe some work with this scope should be 
> progressed as
> a
> > SIP WG item.
> > 
> >
> is

---

From: "Christer Holmberg" <[email-masked]>
Date: Mon, 16 Jun 2008 13:43:15 +0200

Hi,

My position of the draft is supportive.

Regards,

Christer

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of DRAGE, Keith (Keith)
Sent: 12. kesäkuuta 2008 16:50
To: [email-masked]
Subject: Re: [Sip] draft-dotson-sip-mutual-auth-03

(As SIP WG cochair)

I will give a few more days for responses to the question of support / no support.

Regards

Keith

---

From: "Milan Patel" <[email-masked]>
Date: Thu, 19 Jun 2008 18:39:10 +0100

Hi,

I too would like to show support for the draft being progressed as a WG item. The procedures in the draft are indeed useful to 3GPP and the Proxy-Authentication-Info header has been included in 3GPP specifications. The addition of Motivation in section 3 is a useful addition to the draft.

Regards,
Milan

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Christer Holmberg
Sent: 16 June 2008 12:43
To: DRAGE, Keith (Keith); [email-masked]
Subject: Re: [Sip] draft-dotson-sip-mutual-auth-03

Hi,

Regards,

Christer

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of DRAGE, Keith (Keith)
Sent: 12. kesäkuuta 2008 16:50
To: [email-masked]
Subject: Re: [Sip] draft-dotson-sip-mutual-auth-03

(As SIP WG cochair)

Regards

Keith

---

From: "DOLLY, MARTIN C, ATTLABS" <[email-masked]>
Date: Thu, 19 Jun 2008 15:12:23 -0400

Keith,

We are supportive of this draft.

Cheers,

Martin 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Milan Patel
Sent: Thursday, June 19, 2008 1:39 PM
To: DRAGE, Keith (Keith); [email-masked]
Subject: Re: [Sip] draft-dotson-sip-mutual-auth-03

Hi,

Regards,
Milan

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Christer Holmberg
Sent: 16 June 2008 12:43
To: DRAGE, Keith (Keith); [email-masked]
Subject: Re: [Sip] draft-dotson-sip-mutual-auth-03

Hi,

Regards,

Christer

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of DRAGE, Keith (Keith)
Sent: 12. kesäkuuta 2008 16:50
To: [email-masked]
Subject: Re: [Sip] draft-dotson-sip-mutual-auth-03

(As SIP WG cochair)

Regards

Keith

---

From: Hadriel Kaplan <[email-masked]>
Date: Fri, 20 Jun 2008 13:21:16 -0400

Same here.

-hadriel

> DOLLY, MARTIN C, ATTLABS
> Sent: Thursday, June 19, 2008 3:12 PM
> To: Milan Patel; DRAGE, Keith (Keith); [email-masked]
> Milan Patel
> I too would like to show support for the draft being progressed as a WG
> item. The procedures in the draft are indeed useful to 3GPP and the Proxy-
> Authentication-Info header has been included in 3GPP specifications. The
> addition of Motivation in section 3 is a useful addition to the draft.
>
> Regards,
> Milan
>
> Christer Holmberg
> This list is for NEW development of the core SIP Protocol Use sip-
> [email-masked] for questions on current sip Use