Subject: RE: [Sipping] SIP Proxy servers -- security encryption protocol

From: "Scoggins, Sophia" <[email-masked]>
Date: Mon, 23 Feb 2004 09:49:38 -0500

Thanks for the information. For each security association establishment,
there is a significant delay. Depending on the DH group, both phases (phase
1 authentication, phase 2 key exchange) have delays ranging from 2 seconds
to 10 seconds using ISKIKE. That is before any signaling messages started.
This is not acceptable in call processing. 

Is any key exchange protocol recommended? What is the performance (delays)
for key exchange?

Why is AES blocked? AES is supposed to have better performance than 3DES.

Regards,

Sophia

-----Original Message-----
From: Cullen Jennings [mailto:[email-masked]] 
Sent: Sunday, February 22, 2004 3:40 PM
To: [email-masked]; [email-masked]; [email-masked]
Subject: Re: [Sipping] SIP Proxy servers -- security encryption protocol

And the crypto that is typically being recommended and folks are
implementing is RSA for asymmetric key, SHA1 for hash, and 3DES or AES for
encryption. Some of the early stuff said 3DES because the RFC would have
blocked on AES work. It's a long debate with no clear answer between AES and
3DES (and let's not repeat it on this list) but most SIP implementers seem
to be doing AES or both AES and 3DES.  

On 2/19/04 9:26 PM, "[email-masked]"
<[email-masked]> wrote:

Hi
    For secured transactions you could use TLS i.e using sips: instead of
normal sip: url.
Alternatively IPSec also could be used at IP Layer
and for RTP security you could use SRTP (draft-ietf-avt-srtp-09.txt)
protocol.

Regards
Ranjit

-----Original Message-----
From:  [email-masked] [mailto:[email-masked]]
<mailto:[email-masked]%5d>  On Behalf Of  Scoggins, Sophia
Sent: Friday, February 20, 2004 10:45  AM
To: [email-masked]'
Subject: [Sipping] SIP Proxy  servers -- security encryption protocol

 
My group is looking for some  security encryption protocol for both SIP and
RTP streams for CPE. We were  wondering what encryption protocol that most
SIP proxy servers currently  support or intend to support? Would you please
just send your reply to  me?

Thanks.

Regards,
 
[email-masked]

---

From: David Oran <[email-masked]>
Date: Mon, 23 Feb 2004 11:17:25 -0500

--On Monday, February 23, 2004 9:49 AM -0500 "Scoggins, Sophia" 
<[email-masked]> wrote:

> there is a significant delay. Depending on the DH group, both phases
> (phase 1 authentication, phase 2 key exchange) have delays ranging from 2
> seconds to 10 seconds using ISKIKE. That is before any signaling messages
> started. This is not acceptable in call processing.
>
so, set up the TLS connection ahead of time. Do you think you'll have so 
many inter-provider signaling associations that this would be a scalability 
concern?

You should also look into TLS "fast restart" which caches the results of 
the first phase of key management and is only one extra RTT since the 
results of the prior PK computations are kept.

>
>
> Is any key exchange protocol recommended? What is the performance
> (delays) for key exchange?
>
>
>
> implementing is RSA for asymmetric key, SHA1 for hash, and 3DES or AES
> for encryption. Some of the early stuff said 3DES because the RFC would
> have blocked on AES work. It's a long debate with no clear answer between
> AES and 3DES (and let's not repeat it on this list) but most SIP
> implementers seem to be doing AES or both AES and 3DES.
>
> From:  [email-masked] [mailto:[email-masked]] On Behalf
> Of  Scoggins, Sophia
> My group is looking for some  security encryption protocol for both SIP
> and RTP streams for CPE. We were  wondering what encryption protocol that
> most SIP proxy servers currently  support or intend to support? Would you
> please just send your reply to  me?
>
>
>
> Thanks.
>
>
>
> Regards,
>
> [email-masked]
>
>
>
>

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP