Subject: RE: TLS for peering (was RE: Comments(RE:[speermint]requirementsd raftsubmitted))

From: "Drage, Keith (Keith)" <[email-masked]>
Date: Thu, 29 Jun 2006 13:13:16 +0100

Just to be clear. RFC 3261 requires implementations to support TLS. To be conformant it must also response to a SIPS URI with the use of TLS, but presumably it can also reject a request for any reason it likes. 

That does not require it to use a SIPS URI on any outgoing request, and therefore use TLS on outgoing requests.

Therefore substantially the RFC 3261 requirement is to support TLS, not to use it. You seem to be verging on implying that RFC 3261 says it must also be used.

regards

Keith

> -----Original Message-----
> From: Richard Shockey [mailto:[email-masked]]
> Sent: 29 June 2006 03:06
> To: 'Reinaldo Penno'; 'Daryl Malas'
> Cc: 'Khan, Sohel Q [CTO]'; [email-masked]; 'Uzelac, Adam'
> Subject: RE: TLS for peering (was RE:
> Comments(RE:[speermint]requirementsdraftsubmitted))
> 
> 
> 
> 
> > -----Original Message-----
> > From: Reinaldo Penno [mailto:[email-masked]]
> > Sent: Wednesday, June 28, 2006 6:21 PM
> > To: [email-masked]; Daryl Malas
> > Cc: [email-masked]; Khan, Sohel Q [CTO]; Uzelac, Adam
> > Subject: RE: TLS for peering (was RE:
> > Comments(RE:[speermint]requirementsdraftsubmitted))
> > 
> > The following security 'models' come to mind:
> > 
> > 1 - TLS
> > 2 - IPSec
> > 3 - Physical security
> > 4 - Access lists
> > 5 - Registrations
> > 6 - others?
> > 
> > TLS just like the other methods has pros and cons that should be
> > weighted by the persons that will actually use it.
> 
> But it cannot be deprecated. It MUST be supported. Its part 
> of the core SIP
> standard you cannot side step this issue. 
> 
> > 
> > I hope we can agree with that.
> 
> 
> This is exactly where we begin to make progress. Define the reasonable
> security/trust models including TLS that we can find consensus on, the
> smaller the list the better.
> 
> This is really the core problem in spearmint. What is the ultimate
> trust/security model that service providers can rely on to 
> accept traffic
> across domain boundaries. 
> 
> Are you really BT or Sprint or FT or Cablevision etc. Or are 
> you really IBM
> or Ford or Bombardier or Sony for that matter. Can I bill you for your
> traffic? How do I know you are who you say you are.
> 
> 
> 
> > >
> > > _______________________________________________
> > > Speermint mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/speermint
> 
> 
> _______________________________________________
> Speermint mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/speermint
> 

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint

---

From: "Richard Shockey" <[email-masked]>
Date: Thu, 29 Jun 2006 09:44:08 -0400

> From: Drage, Keith (Keith) [mailto:[email-masked]]
> Sent: Thursday, June 29, 2006 8:13 AM
> To: [email-masked]'; 'Reinaldo Penno'; 'Daryl Malas'
> Just to be clear. RFC 3261 requires implementations to support TLS. To be
> conformant it must also response to a SIPS URI with the use of TLS, but
> presumably it can also reject a request for any reason it likes.

OF course.

> Therefore substantially the RFC 3261 requirement is to support TLS, not to
> use it. You seem to be verging on implying that RFC 3261 says it must also
> be used.
> 
> 

Apologies is I was not clear. You MUST support TLS as one of multiple
security/trust options.