Subject: [Sipping] e2m security open issue: notification with error codes

From: Kumiko Ono <[email-masked]>
Date: Tue, 26 Oct 2004 19:10:14 +0900

Hi,

Here is the second issue on mechanism of e2m security.

Open Issue#2: How does a proxy server notify the needs of end-to-middle 
security to the UAC by using error codes?

After discussion with some of the WG member, and giving some thought on 
how UAC might realize the need of e2m security utilization, I realized 
that proxy should have a way to notify the UAC about e2m security 
utilization in addition to using UAC driven method, such as session 
policy package. 

There are two cases where a proxy server needs a UAC to utilize
end-to-middle security in its communication.
1) When the proxy server needs to view an encrypted data sent by UAC. We 
can say this case to be somewhat of a security downgrading and it 
requires end-to-middle confidentiality.
2) When the proxy server needs to validate the data integrity of the 
message. We can say this to be somewhat of a security upgrading, and it 
requires end-to-middle integrity.
In both cases, the information for notification (error codes) to UAC 
should include the case (reason) and target content type. 

Looking at pre-existing error codes, "493 Undecipherable" can be 
utilized for the first case as it means that peer requires the 
capability to decrypt. However, there are no error codes that indicate 
its requirement to carry out an integrity validation. 
I think we need a new error code, such as "495 Signature required" for 
clarification. Also as stated above, I think that the target content 
type should be described in Warning header.

Your feedback is very welcome.

Thanks in advance,
Kumiko
--
Kumiko Ono
NTT Network Service Systems Labs.
Tel +81 422 59 4508/Fax +81 422 60 4012

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: David R Oran <[email-masked]>
Date: Wed, 27 Oct 2004 11:17:03 -0400

Again, good description and analysis. I agree with your conclusion.
Dave.

> Your feedback is very welcome.
David R. Oran
Cisco Fellow
Cisco Systems
7 Ladyslipper Lane
Acton, MA 01720 USA
Tel: +1 978 264 2048
Email: [email-masked]