Subject: RE: TLS for peering (was RE: Comments(RE:[speermint]requirementsdraft submitted))

From: "McCandless, Kevin" <[email-masked]>
Date: Fri, 30 Jun 2006 10:26:55 -0500

A voice of reason among the group.  

We went through this very discussion, in Sigtran, and came out that
IPSEC works just as well and left the choice to the implementers between
IPSEC and TLS.  Why not leverage this work?  See RFC
http://www.ietf.org/rfc/rfc3788.txt, especially sections 7 & 8.

-----Original Message-----
From: Andrew Newton [mailto:[email-masked]] 
Sent: Friday, June 30, 2006 9:31 AM
To: Rohan Mahy
Cc: Khan, Sohel Q [CTO]; [email-masked]; Uzelac, Adam
Subject: Re: TLS for peering (was RE:
Comments(RE:[speermint]requirementsdraft submitted))

Rohan,

I am not a liberty to give specific numbers, but I can assure you  
that your assumptions are wrong.  We have a lot of very expensive  
equipment that would fall over if it did all signaling over TLS or  
even just TCP.  And we have done the tests and measurements, and a  
$2000 rack mount server cannot handle the load.

And since you are asking for "real requirements", I'd like to know  
what your "real requirements" are for specifying TLS for signaling.   
Specifically, I'd like to know the following:

1) Why is it you are advocating security of the signaling but not the  
media?  What requirement determines that signaling is important to  
secure but media is not important to secure?
2) Why do you believe TLS offers better authentication than any other  
method, especially given that there is no global trust anchor?
3) What requirement makes TLS more secure than a dedicated link?
4) What requirement makes TLS more secure than IPSec?
5) Given that providers interconnect today without TLS, what  
requirement is not met by the current interconnection methods that  
TLS will provide?

Don't get me wrong.  I think all vendors should support TLS, and I  
think providers and carriers should be able to have it at their  
disposal when doing interconnection, but it is only one of many options.

-andy

On Jun 29, 2006, at 8:05 PM, Rohan Mahy wrote:

> Andy,
>
> What you've described are a bunch of hacks that service providers use
> because they don't peer over the Internet or because they can't rely
> on the other guy to support TLS.  The combination of hacks is much,
> much more expensive in terms of both capital equipment and
> operationally than just using TLS.
>
> A $2000 rack mount server can encrypt and decrypt a phenominal volume
> of TLS traffic.  Hardware crypto accellerators are available that
> increase this volume and decrease initial TLS handshake latencies by
> another couple of orders of magnitude.
>
> I'm willing to bet a few beers that the amount of data that is
> encrypted using TLS exceeds the total volume of PSTN signaling traffic
> on a daily basis.
>
> To those who have a problem with TLS, I ask them to provide some
> quantitative data or real requirements rather than rhetoric and FUD.
>
> thanks,
> -rohan
>
>
>
>
>
> On 6/28/06, Andrew Newton <[email-masked]> wrote:
>>
>> On Jun 28, 2006, at 2:48 PM, Richard Shockey wrote:
>> > how do you propose to establish a trust relationship between SIP
>> > domain
>> > boundaries without TLS?
>>
>> There are other methods: security lower in the stack, private
>> connections, address ACLs...  the things that providers use today.
>>
>> > If you cannot establish a trust relationship between  
>> interconnecting
>> > partners then what is the purpose of this whole exercise?
>>
>> To answer the second part of that sentence: I don't know; I've been
>> asking that question for quite some time.
>>
>> -andy
>>
>> _______________________________________________
>> Speermint mailing list
>> [email-masked]
>> https://www1.ietf.org/mailman/listinfo/speermint
>>

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint

---

From: Benjamin Black <[email-masked]>
Date: Fri, 30 Jun 2006 08:44:02 -0700

kevin,

3788 is a very useful reference for this discussion.  i think  
speermint needs both better specified requirements and a richer set  
of options, however.

bb