Subject: Re: [Speermint] Just submitted draft-mahy-speermint-direct-peering-00

From: Klaus Darilion <[email-masked]>
Date: Fri, 21 Jul 2006 10:32:11 +0200

Hi Rohan!

Sorry for jumping in late - I had long holidays. I have a few concerns 
about the TLS stuff:

> 4.1.6  Setup TLS connection
> 
>    Once a transport, port, and address are found, the initiating peer
>    will open or find a reusable TLS connection to the peer.  The
>    initiating provider MUST verify the server certificate which SHOULD
>    be rooted in a well-known certificate authority.  The initiating

How should the validation be done? You describe how the client 
validation works, but not the server validation.

>    provider MUST be prepared to provide a TLS client certificate upon
>    request during the TLS handshake.  The client certificate MUST
>    contain a DNS or URI choice type in the subjectAltName which
>    corresponds to the domain asserted in the host production of the From
>    header URI.  The certificate SHOULD be valid and rooted in a well-

This will break the SMTP-style forwarding. Simple scenario:
sip:alice@aaa call bob@bbb which is a forward to bob@ccc

Thus, when ccc's proxy receive the INVITE, the headers are
From: sip:alice@aaa
To: bob@bbb

Thus, when ccc validates the certificate from bbb it won't match the 
domain in the from header.

Further, how will the validation works for in-dialog requests, for which 
a new TLS connection is required? The request URI will not contain the 
domain of the next hop. Thus, should certificate validation for 
in-dialog requests be done against the topmost Route header?

regards
klaus

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint