Subject: [Sipping] Comments on draft-ietf-sipping-update-pai-07

From: Cullen Jennings <[email-masked]>
Date: Sun, 9 Nov 2008 19:09:25 -0700

I like this version it seems to have resolved many of the things I was  
worried about.

One significant thing...

Saying you can use PAI to authenticate registrations seems like an  
update to 3261 not 3325. This seems like a pretty big change to SIP  
security. I also have a hard time imagining the type of UA that would  
both need to register, and were in the Trust Domain.

Nits.

I don't recall 3325 being unclear on use of PAI in responses. It  
explicitly did not define it - there not much unclear about that.

Cullen in my individual contributor roll
_______________________________________________
Sipping mailing list  https://www.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: "DRAGE, Keith \(Keith\)" <[email-masked]>
Date: Mon, 10 Nov 2008 03:12:12 +0100

RFC 3325 did not explicitly say anything much about the responses, but
there was text in RFC 3325 that did signify responses.

We have discussed this in the past, you have your view and I have mine -
but please not not state that it is explicitly covered because that is
not true.

regards

Keith 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Cullen Jennings
> Sent: Monday, November 10, 2008 2:09 AM
> To: sipping
> Subject: [Sipping] Comments on draft-ietf-sipping-update-pai-07
> 
> 
> I like this version it seems to have resolved many of the 
> things I was worried about.
> 
> One significant thing...
> 
> Saying you can use PAI to authenticate registrations seems 
> like an update to 3261 not 3325. This seems like a pretty big 
> change to SIP security. I also have a hard time imagining the 
> type of UA that would both need to register, and were in the 
> Trust Domain.
> 
> Nits.
>

---

From: "Elwell, John" <[email-masked]>
Date: Tue, 11 Nov 2008 08:17:36 +0000

Cullen, 

Thanks for your comments. See below.

> Sent: 10 November 2008 02:09
> To: sipping
[JRE] I think the use case people who proposed this had in mind was an
edge proxy authenticating the UA (which would indeed be outside its
trust domain) and then forwarding the REGISTER request with PAI to the
registrar.

> explicitly did not define it - there not much unclear about that.
[JRE] It definitely is unclear. It sometimes talks about SIP messages,
without saying whether these are requests or responses or both. On that
basis, it is hardly surprising that many have implemented PAI in
responses.

I should also add that there are some who are very dissatisfied with
removal of the response stuff from the present draft, and I have asked
them to provide a concrete example of how a response is authenticated
(e.g., how 3GPP does it). This issue is not closed yet!

John