Subject: [Sipping] RFC3263 SIPS URI transport selection

From: "Frank Shearar" <[email-masked]>
Date: Fri, 18 Feb 2005 09:47:40 -0000

In RFC 3263 section 4.1 we find an algorithm for determining the appropriate transport to use when sending a message to a URI.

Suppose then that the client didn't specify a transport, so we have to inspect the URI to figure out the appropriate transport. Suppose further the URI is a SIPS URI.

RFC 3263 says this at the beginning of section 4.1:

   If the URI specifies a transport protocol in the transport parameter,
   that transport protocol SHOULD be used.

   Otherwise, if no transport protocol is specified, but the TARGET is a
   numeric IP address, the client SHOULD use UDP for a SIP URI, and TCP
   for a SIPS URI.

My question is regarding the "and TCP for a SIPS URI" bit: shouldn't this be "and TLS over TCP" or something? Or "a secure reliable transport" even?

It seems to me that by saying "and TCP for a SIPS URI" that the RFC regards it as acceptable for a SIP entity to send this message over an insecure link. That can't be right, so what have I missed?

frank

*******************************************************************
This email and attachments (if any) must be swept for viruses before opening. Their contents may be confidential or privileged and are intended solely for the named recipient. If you are not the intended recipient and you have received this email in error you must not read or use this email and should notify RNID on: +44 (0) 20 7296 8282.

RNID, Registered Office 19-23 Featherstone Street, London EC1Y 8SL No. 454169 (England, Registered Charity No. 207720)

********************************************************************

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Dean Willis <[email-masked]>
Date: Fri, 18 Feb 2005 14:51:15 -0600

On Feb 18, 2005, at 3:47 AM, Frank Shearar wrote:

> My question is regarding the "and TCP for a SIPS URI" bit: shouldn't 
> this be "and TLS over TCP" or something? Or "a secure reliable 
> transport" even?
>
> It seems to me that by saying "and TCP for a SIPS URI" that the RFC 
> regards it as acceptable for a SIP entity to send this message over an 
> insecure link. That can't be right, so what have I missed?

There was a some argument about this when we were working on the text 
for 3263. It went something like "TCP and UDP are "transport" 
protocols. TLS is a mechanism for securing TCP connections. So the 
transport is TCP, even for SIPS, and saying TLS is a transport would be 
incorrect. So let's say TCP here, and elsewhere define that TLS MUST be 
used as a protection mechanism when the URI is a a sips: type."

--
Dean

---

From: Juha Heinanen <[email-masked]>
Date: Sat, 19 Feb 2005 22:38:36 +0200

Dean Willis writes:

 > So let's say TCP here, and elsewhere define that TLS MUST be 

i have another question related to uris and tls.  if someone wants to
use tel uri, is there tels: to specify that tls must be used and, if
not, why?  if not, i guess if someone want to use tel uri and specify
tls transport, he must use sips:+number@somedomain;user=phone or what?
does not look good on a business card though.

-- juha