Subject: RE: AW: [Sipping] FYI: RADIUS & SIP

From: "Jill B Gemmill" <[email-masked]>
Date: Thu, 7 Aug 2003 10:41:24 -0500

Why not include PKI (digital certificates) and API to Peterson's
Authentication Service
http://www.ietf.org/internet-drafts/draft-ietf-sip-identity-01.txt in
the options space?

> -----Original Message-----
> From: Henry Sinnreich [mailto:[email-masked]]
> Sent: Thursday, August 07, 2003 9:00 AM
> To: [email-masked]; 'Henry Sinnreich'; [email-masked]
> Cc: [email-masked]; [email-masked]
> Subject: RE: AW: [Sipping] FYI: RADIUS & SIP
> 
> > I'm not really sure if its productive to debate RADIUS vs.
> > DIAMETER deployment status or deficiences.
> 
> I agree, and we should add WEB SERVICES to the list - probably the
most
> important contender. To get away from this discussion, the draft on
SIP-
> AAA
> needs an additional chapter with an objective comparison on various
> options,
> and to discuss the pros and cons of such as RADIUS, DIAMETER and WEB
> SERVICES. (BTW: Is there a lack of expertise on web services in the
> SIPPING
> WG? Some well know WEB SERVICES vendors come to my mind...Invite
them?)
> 
> A discussion of options is the only basis on which to proceed IMHO.
> 
> Comments?
> 
> Thanks, Henry
> 
> > -----Original Message-----
> > From: Jari Arkko [mailto:[email-masked]]
> > Sent: Thursday, August 07, 2003 8:09 AM
> > To: Henry Sinnreich; [email-masked]
> > Cc: [email-masked]; [email-masked]
> > Subject: Re: AW: [Sipping] FYI: RADIUS & SIP
> >
> >
> > Hello folks,
> >
> > I'm not really sure if its productive to debate RADIUS vs.
> > DIAMETER deployment status or deficiences. I don't see
> > them as competing alternatives as much as I see them
> > as complementary approaches.
> >
> > Here's what I'd like to have:
> >
> > 1. Published (RFC) specifications for carrying HTTP
> >     Digest over RADIUS. Maybe start from draft-sterman.
> > 2. Published specifications for the same thing and
> >     a few additional features over DIAMETER. Start from
> >     draft-belinchon, but make it less 3GPP-specific.
> > 3. As a part of 2, interworking specification
> >     between RADIUS & DIAMETER (possibly limited
> >     to the scope of features supported under 1).
> > 4. Prepaid support module for DIAMETER that can
> >     work with any application, such as SIP or network
> >     access. This is work in progress, as John noted.
> > 5. Optionally, a prepaid module for RADIUS,
> >     constructed in a manner which makes translation
> >     to 4 possible.
> >
> > This will enable folks with either RADIUS or
> > DIAMETER servers to put them together with their
> > SIP nodes, and will enable gradual transition from
> > RADIUS to DIAMETER, which will likely take time. The
> > idea is that AAA proxies start supporting both
> > protocols, so you don't have to switch your NASes/
> > SIP proxies all at the same time.
> >
> > Please also note that SIP is not the only thing
> > where RADIUS vs. DIAMETER issues arise. In network
> > access, for instance, the AAA WG has produced a
> > specification which works over DIAMETER in a manner
> > compatible with the current RADIUS network access
> > usage. Similarly, in EAP authentication over RADIUS
> > can interwork with EAP authentication over DIAMETER,
> > albeit with DIAMETER the security issues related to
> > key transport are easier.
> >
> > --Jari
> 
> 
> _______________________________________________
> Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
> This list is for NEW development of the application of SIP
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments of core SIP

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Henry Sinnreich <[email-masked]>
Date: Thu, 07 Aug 2003 11:33:42 -0500

> Why not include PKI (digital certificates) and API to Peterson's

Excellent suggestion! We have now four options to discuss in the SIP-AAA
I-D.

Thanks, Henry

> From: Jill B Gemmill [mailto:[email-masked]]
> Sent: Thursday, August 07, 2003 10:41 AM
> To: Henry Sinnreich; [email-masked]; [email-masked]

---

From: Jari Arkko <[email-masked]>
Date: Fri, 08 Aug 2003 12:48:06 +0300

Henry Sinnreich wrote:

> We have now four options to discuss in the SIP-AAA
> I-D.

Hmm.... again, I'm worried that we're spending too much
time arguing about the different underlying options.
We could easily end up in a lengthy beauty contest and
leave everyone using expired I-Ds and vendor specific
things in the meanwhile -- which is the current state of
affairs.

 From what I can see, folks have required SIP auth and
acct services for both RADIUS and DIAMETER. Lets give
these to them, and ensure that they can work together
so that folks who want high reliability, for instance,
can upgrade to DIAMETER without breaking the possibility
of talking to someone who only does RADIUS.

--Jari

---

From: Henry Sinnreich <[email-masked]>
Date: Fri, 08 Aug 2003 09:16:21 -0500

> time arguing about the different underlying options.

The SIP-AAA WG has to find the best solution for SIP-AAA and is not a venue
to promote DIAMETER. 

Certainly no decision should be made without evaluating all available
options.

Thanks, Henry

> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Jari Arkko
> Sent: Friday, August 08, 2003 4:48 AM
> To: Henry Sinnreich
> Cc: [email-masked]; [email-masked]; [email-masked]