Subject: note: TLS for peering (was RE: Comments(RE:[speermint]requirementsdraftsubmitted))

From: "Livingood, Jason" <[email-masked]>
Date: Wed, 28 Jun 2006 18:18:33 -0400

Thanks everyone for coming to the fair today.  Please step away from
your keyboards and go home for the evening and have a nice, cold beer.
:-)  I'm in Belgium at the moment, so there's no shortage of that.

Let's resume again tomorrow and reduce the tone just a few notches
please.

There are valid points on **both** sides of the issue that can be
discussed on the list and, perhaps best in person in Montreal.  Both
sides ought to duly consider the dispassionate arguements.

We will need to keep in mind that for now, we are focusing on the bare
minimum set of requirements to get VoIP peering working (as a first use
case).  There will surely be issues that come up, perhaps like this one,
in a BCP or later/other document that says something like "oh, by the
way, if you want to protect X/Y/Z or whatever, you really out to
implement A/B/C."  So I think there are ways to satisfy both sides of
the issue here and this is not an all or nothing scenario.  We can all
be right and all feel the love. ;-)

It'd be helpful to discuss this more but maybe for now we can table this
for 24 hours or something like that.

Jason

> -----Original Message-----
> From: Richard Shockey [mailto:[email-masked]] 
> Sent: Wednesday, June 28, 2006 5:49 PM
> To: 'Daryl Malas'
> Cc: [email-masked]; 'Khan, Sohel Q [CTO]'; 'Uzelac, Adam'
> Subject: RE: TLS for peering (was RE: 
> Comments(RE:[speermint]requirementsdraftsubmitted))
> 
> 
> 
> > -----Original Message-----
> > From: Daryl Malas [mailto:[email-masked]]
> > Sent: Wednesday, June 28, 2006 5:24 PM
> > To: [email-masked]
> > Cc: 'Khan, Sohel Q [CTO]'; 'Uzelac, Adam'; [email-masked]
> > Subject: RE: TLS for peering (was RE:
> > Comments(RE:[speermint]requirementsdraft submitted))
> > 
> > ...I simply said REQUIRING it would be unrealistic...I didn't say 
> > including it as an optional method is unrealistic.  There 
> are multiple 
> > ways to authenticate peers as described in Penno's message 
> flows draft.
> 
> 
> Ah .. you are heading into a semantic trap here. 
> 
> My position is any proposed BCP in SPEERMINT for intercarrier 
> interconnection ( did I say peering here :-) using SIP MUST 
> support a trust/security model.  I'm not saying you should be 
> REQUIRED to use TLS at all times but only that you MUST 
> support TLS as one of the supported models.
> 
> It is my opinion based on many years of personal experience 
> in the IETF that you that you will not get anything through 
> the IESG to an RFC unless something like the above position 
> is incorporated into the drafts.
> 
> 
> 
> > 
> > On Wed, 2006-06-28 at 14:28 -0400, Richard Shockey wrote:
> > >
> > > TLS is a core part of the SIP specification. Saying its not 
> > > realistic is just plain bovine effluent.
> > >
> > > You are not going to interconnect at the most basic level unless 
> > > there
> > is a
> > > level of trust between the domains. So how do you plan on 
> > > authenticating
> > the
> > > domain?
> > >
> > > This was the absolute conclusion of the SIP Forum when we came up 
> > > with
> > the
> > > SIP Connect specification for PBX to SP interconnection.
> > >
> > > SP to SP interconnection is not that much different.
> > >
> > > http://data.memberclicks.com/bbattach/130808/sf-draft-twg-
> > IP_PBX_SP_Interop-
> > > sibley-final.pdf
> > >
> > > <sigh>
> > >
> > > > -----Original Message-----
> > > > From: Khan, Sohel Q [CTO] [mailto:[email-masked]]
> > > > Sent: Wednesday, June 28, 2006 12:06 PM
> > > > To: Daryl Malas; Uzelac, Adam
> > > > Cc: [email-masked]
> > > > Subject: RE: TLS for peering (was RE: Comments 
> > > > (RE:[speermint]requirementsdraft submitted))
> > > >
> > > > So, what do u recommended ?
> > > > Keep TLS optional?
> > > > Any other method?
> > > >
> > > > Sohel
> > > >
> > > >
> > > > -----Original Message-----
> > > > From: "Daryl Malas" <[email-masked]>
> > > > To: "Uzelac, Adam" <[email-masked]>
> > > > Cc: "[email-masked]" <[email-masked]>
> > > > Sent: 6/28/06 10:29 AM
> > > > Subject: RE: TLS for peering (was RE: Comments (RE:
> > > > [speermint]requirementsdraft submitted))
> > > >
> > > > I agree with Adam's assessment.  Requiring TLS is simply not 
> > > > realistic at this point.  I believe it has the potential of 
> > > > becoming a more
> > common
> > > > practice in the future, but not right now.
> > > >
> > > > --Daryl
> > > >
> > > > On Tue, 2006-06-27 at 21:47 -0400, Uzelac, Adam wrote:
> > > > > TLS is becoming more and more a subject when the topic of SIP 
> > > > > interconnections arises for me professionally.  This shows 
> > > > > growing momentum indeed.  With that said, I can not 
> agree with 
> > > > > TLS as a steadfast requirement.  Economics and scale 
> are my major concerns.
> > TLS
> > > > > adds cost, server load, and there are fail-over issues to 
> > > > > consider
> > as
> > > > > well.  For the person that designs an interconnect, I believe
> > weighing
> > > > > the cost against the benefit of the different models a useful
> > exercise.
> > > > > Mandating TLS, even if all parties involved in a peering 
> > > > > arrangement feel somehow "safe and secure" due to underlying 
> > > > > security mechanisms (L2/L3VPNs, etc), seems a little harsh.
> > > > >
> > > > > Adam
> > > > >
> > > > > -----Original Message-----
> > > > > From: Medhavi Bhatia [mailto:[email-masked]]
> > > > > Sent: Tuesday, June 27, 2006 8:44 PM
> > > > > To: Reinaldo Penno
> > > > > Cc: [email-masked]
> > > > > Subject: Re: TLS for peering (was RE: Comments (RE: 
> [speermint] 
> > > > > requirementsdraft submitted))
> > > > >
> > > > > I am not a provider yet, but I think we dont need to mess with
> > TLS/TCP.
> > > > > As I understand one of the goals is to prevent the calls from
> > failing
> > > > > due to "peering only" reasons. This means that things like 
> > > > > codecs
> > which
> > > > > are not negotiated by the peers need to be mandated 
> at a minimal
> > level.
> > > > > TCP/TLS can be negotiated between the peers 
> themselves so it is 
> > > > > a non-issue. Also as I still understand doing a high volume 
> > > > > calls with
> > TLS
> > > > > is still expensive. Mandating TLS in cases where the caller or
> > callee
> > > > > dont require it doesnt seem to add any value.
> > > > >
> > > > > -Medhavi.
> > > > >
> > > > > On 6/27/06, Reinaldo Penno <[email-masked]> wrote:
> > > > > >
> > > > > > TLS for _all_ scenarios? Even in private peerings, 
> physically
> > secure
> > > > > > peerings, etc?
> > > > > >
> > > > > > Isn't that the same as requiring IPsec for all 
> layer 3 peering?
> > But
> > > > > > since Layer 5 peering might be more distributed, 
> the number of 
> > > > > > TLS sessions would be huge.
> > > > > >
> > > > > > It would be good to hear the provider's opinion on this...
> > > > > >
> > > > > > Thanks,
> > > > > >
> > > > > > Reinaldo
> > > > > >
> > > > > > > -----Original Message-----
> > > > > > > From: Brian Rosen [mailto:[email-masked]]
> > > > > > > Sent: Tuesday, June 27, 2006 2:12 PM
> > > > > > > To: 'Jean-Francois Mule'; Reinaldo Penno
> > > > > > > Cc: [email-masked]
> > > > > > > Subject: RE: Comments (RE: [speermint] requirements draft
> > submitted)
> > > > > > >
> > > > > > > >
> > > > > > > > "3.4.  Security requirements
> > > > > > > >
> > > > > > > >    All SIP messages MUST be sent over TLS 
> [RFC3546] to provide
> > > > > > > >    transport-layer security as defined in RFC 3261,"
> > > > > > > >
> > > > > > > > Giving the fact that we can have security 
> through physical
> > > > > > > segregation,
> > > > > > > > intra-federation/provider calls, etc, the "MUST" here 
> > > > > > > > seems
> > too
> > > > > > > > generic.
> > > > > > >
> > > > > > > I tend to differ on this: it is not because you 
> have lower 
> > > > > > > layer security (presumably hop by hop security 
> associations) 
> > > > > > > that you should relax the end-to-end transport 
> security requirements.
> > > > > > > Rohan's well written draft is also in favor of mandatory 
> > > > > > > support
> > of
> > > > > > TLS,
> > > > > > > and so is the SIP Forum's IP PBX to VSP (here is 
> a working link:
> > > > > > >
> > > > > > http://data.memberclicks.com/bbattach/130808/sf-draft-twg-
> > IP_PBX_SP_In
> > > > > > te
> > > > > > > rop-sibley-final.pdf).
> > > > > > > May be the requirement should be rewritten to put 
> the MUST 
> > > > > > > on
> > SIP
> > > > > > > entities involved in L5 peering.
> > > > > > >
> > > > > > > <brian>I'm in favor of requiring TLS.  I'd say MUST in a
> > heartbeat.
> > > > > > >
> > > > > > > Brian
> > > > > >
> > > > > > _______________________________________________
> > > > > > Speermint mailing list
> > > > > > [email-masked]
> > > > > > https://www1.ietf.org/mailman/listinfo/speermint
> > > > > >
> > > > >
> > > > > _______________________________________________
> > > > > Speermint mailing list
> > > > > [email-masked]
> > > > > https://www1.ietf.org/mailman/listinfo/speermint
> > > > >
> > > > > _______________________________________________
> > > > > Speermint mailing list
> > > > > [email-masked]
> > > > > https://www1.ietf.org/mailman/listinfo/speermint
> > > >
> > > >
> > > > _______________________________________________
> > > > Speermint mailing list
> > > > [email-masked]
> > > > https://www1.ietf.org/mailman/listinfo/speermint
> > > >
> > > >
> > > >
> > > > _______________________________________________
> > > > Speermint mailing list
> > > > [email-masked]
> > > > https://www1.ietf.org/mailman/listinfo/speermint
> 
> 
> _______________________________________________
> Speermint mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/speermint
> 

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint