Subject: Re: [Sip] Moving forward on the identity discussion (was: Interim meeting in Malta)

From: "Elwell, John" <[email-masked]>
Date: Thu, 06 Nov 2008 08:03:02 +0000

In trying to address this issue for the last year or more, it is quite
clear that it is difficult to discuss in a structured way. However, I
would suggest the following order of discussion:
- What does a user want to know about the identity of a communication
partner, the authenticity of that identity and the security state of the
communication?
- How important is end-to-end, as opposed to hop-by-hop security
(including authenticated identity)?
- What do we have in our toolkit at present to meet these user
expectations?
- What are the barriers to deploying identity solutions based on these
tools, and what are the root causes of these barriers?
- What mechanisms could be devised for overcoming these deployment
difficulties, and what are the pros and cons of each?
- What are the additional problems arising from the use of E.164-based
URIs, and are there mechanisms that could solve these problems?
- What are the additional problems arising from PSTN interworking, and
are there mechanisms that could solve these problems?

There are already some drafts that address one or more of these points.
But if we were to publish a structure to the discussion in advance, we
could try to solicit drafts addressing particular points.

John

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of DRAGE, Keith (Keith)
> Sent: 31 October 2008 17:19
> To: SIP IETF
> Subject: [Sip] Interim meeting in Malta
> 
> (As WG chair)
> 
> The SIP and SIPPING chairs have agreed (with the support of 
> the AD) that
> both SIP and SIPPING WGs will meet in Malta at the proposed interim
> meeting 20th - 22nd January 2009. There are still arrangements to be
> made as to precise dates and time allocation, but this should give you
> enough time to go ahead and reserve flights at the cheapest rates.
> 
> You can see information here about the interim which will be 
> updated as
> it developes.
> 
> http://trac.tools.ietf.org/2009/jan-large-interim/
> 
> For SIP, what we will be looking for is agenda items that need some
> considerable in depth discussion with large blocks of time, 
> rather than
> those that require 15 minute slots to make one decision. If 
> you believe
> there is a subject area that would benefit from such detailed 
> discussion
> (yours draft or someone elses), then please send us an email 
> before the
> start of IETF#73, so that we can float a tentative agenda at 
> the SIP WG
> meeting there.
> 
> I strongly suspect we may have an identity discussion at the interim
> meeting, but would appreciate ideas on the best way of moving 
> forward on
> this subject.
> 
> All decisions of the interim meeting will of course be taken 
> to the list
> in some form or other.
> 
> regards
> 
> Keith
> _______________________________________________
> Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip
> 
_______________________________________________
Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Elwell, John" <[email-masked]>
Date: Mon, 10 Nov 2008 19:30:50 +0000

Dean,

(Moving back to the SIP list, which accidentally got dropped from cc list a few postings ago).

Yes, I was wondering whether SAML would fit in here somehow. 

John

> From: Dean Willis [mailto:[email-masked]] 
> Sent: 10 November 2008 17:54
> To: Elwell, John
> Cc: Dan York; Victor Pascual Ávila; Dan Wing; DRAGE, Keith 
> (Keith); Henry Sinnreich; Jiri Kuthan; Alan Johnston; Juha 
> Heinanen; [email-masked]; dale.worley; [email-masked]
> Subject: Re: [Sip] Moving forward on the identity discussion 
> (was: Interim meeting in Malta)
> 
> 
> On Nov 10, 2008, at 1:18 AM, Elwell, John wrote:
> 
> > Dan,
> >
> > The present RFC 4474 assumes that the Authentication Service is  
> > collocated with a proxy on the SIP signalling path. The way I view  
> > the scenario you describe below is that the Authentication Service  
> > is not on the signalling path, and therefore it would seem to  
> > require a protocol between a proxy and an Authentication 
> Service in  
> > order that the proxy can obtain the necessary signature. I 
> would see  
> > that as a separate work item, which could be pursued later 
> (after we  
> > have solved the basic RFC 4474 problems.
> >
> 
> 4474 allows the auth server to be on-path or of, though on is  
> simplest. It even allows the auth server to be invoked from the UAC  
> via some unspecified protocol, such as that other SAML draft that is  
> kicking around.
> 
> > By the way, any particular reason why this discussion moved 
> off-list?
> >
> 
> Paranoia?
> 
> --
> Dean
>