Subject: [Speermint] TLS, etc - Local-policy versus WG mandate

From: "Uzelac, Adam" <[email-masked]>
Date: Wed, 12 Jul 2006 14:44:21 -0400

Pertaining to the "To TLS or not TLS" discussion in the WG sessions,
time didn't permit a proper tomato tossing session at the WG session -
but one comment was made about mandating such things as TLS, etc - to
which a rebuttal was made that the type of authentication and
authorization used and implemented is an issue of local policy and
therefore shouldn't be mandated.  

For fear of starting a "great taste" versus "less filling" argument -
Let me start this way....I agree with what appeared to be consensus in
the WG session that there needs to be first a Discovery procedure, then
an Authentication procedure, and finally connecting the call.  The
methods upon which each step along the way is done should not to so
narrow as to exclude popular and in some cases widely adopted methods.
Speermint should provide the BCP - but does that really need to exclude
other plausible and practical models?  It's important to note that I
believe TLS is the most appropriate, practical and logical approach.  I
also believe the there are valid reasons for other approaches to
authenticate.  The same holds true for methods of discovery. 

So the question for the group and possibly some guidance from the chairs
here?!?!? - Should an undertaking to determine what should be determined
via local policy versus mandated via 'MUSTs' be done?  Is this a section
for the requirements doc?

I would like to thank Rohan for bringing this issue to the forefront in
a lightning-rod manner!! ;)

Regards,

Adam

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint

---

From: "Stastny Richard" <[email-masked]>
Date: Wed, 12 Jul 2006 21:12:26 +0200

>other plausible and practical models? 
 
BCP  means best current practice - so if we say TLS IS the best current practice
does this prevent somebody not to use TLS?
 
OTOH, only one one method can be best  - at least for now (current)
 
Richard

________________________________

Von: Uzelac, Adam [mailto:[email-masked]]
Gesendet: Mi 12.07.2006 20:44
An: [email-masked]
Betreff: [Speermint] TLS, etc - Local-policy versus WG mandate

Regards,

Adam

---

From: "Brian Rosen" <[email-masked]>
Date: Wed, 12 Jul 2006 15:22:27 -0400

Due to the last minute schedule change, I was unable to attend the meeting,
but perhaps we now have enough consensus to write down the answer.

I think we use the methods we have used in most of the sippish specs:

It's mandatory to IMPLEMENT TLS between peers (presumably peer proxies).
It's mandatory to DEPLOY some kind of mutual authentication, which does not
have to be TLS.  

I suspect that we want to actually say that the federation establishes a
particular authentication standard that all members use.

Brian

-----Original Message-----
From: Uzelac, Adam [mailto:[email-masked]] 
Sent: Wednesday, July 12, 2006 2:44 PM
To: [email-masked]
Subject: [Speermint] TLS, etc - Local-policy versus WG mandate

Regards,

Adam

---

From: Andrew Newton <[email-masked]>
Date: Wed, 12 Jul 2006 21:03:06 -0400

On Jul 12, 2006, at 2:44 PM, Uzelac, Adam wrote:
> an Authentication procedure, and finally connecting the call.

For those of us who were not able to attend the entire meeting, can  
somebody provide the description of the function of this discovery  
mechanism and a use case?

-andy

---

From: "Stastny Richard" <[email-masked]>
Date: Thu, 13 Jul 2006 06:21:36 +0200

>mechanism and a use case?

The the both lendl I-Ds and the presentation from Michael Haberler

The basic idea is that you check first if you are able to establish a secure path
to the destination network at all by checking the policy, then you establish a
secure path (e.g by TLS) and then you send the invite.
 
The reason is to avoid being rejected 
 
Richard

Von: Andrew Newton [mailto:[email-masked]]
Gesendet: Do 13.07.2006 03:03
An: Uzelac, Adam
Cc: [email-masked]
Betreff: Re: [Speermint] TLS, etc - Local-policy versus WG mandate

-andy

---

From: "David Schwartz" <[email-masked]>
Date: Thu, 13 Jul 2006 17:05:20 +0300

So here are my two cents (just repeating what I said at the session)

My claim which was not directly rebuffed is why authentication is any
different than any other policy issue. As far as I can tell there are 2
not 3 issues that need to be resolved for peering to occur.

1. Where is the other side
2. Can we communicate

If we focus on the second issue it includes things like
 
* Will the other side even accept a call from me
* Assuming other side will accept my calls
*    Which authentication mechanism do I use for this communication- if
any
* what are the ground rules for communication (e.g. specific codecs)
* etc.

I think of federations as shared namespace NOT policy. Federations are
comprised of one namespace and multiple policy federations describing
the relationships between the members. This is why for the life of me I
cannot understand why it is not ok with me to peer with A via TLS and
with B with IPSec and with 3 with no authentication at all.
Authentication is just a policy decision and should NOT be mandated.

I know everybody will yell at this but to me making ANY security
mechanism mandatory is tantamount to making a minimal codec set
mandatory and we know how this list reacted when that was proposed. 

If any member is dumb enough not to implement TLS or IPSec or some other
security mechanism he will soon find that no one will accept traffic
from him and implement it then.

We do not have to mandate not being STUPID. 

Cheers,

David

-----Original Message-----
From: Uzelac, Adam [mailto:[email-masked]] 
Sent: Wednesday, July 12, 2006 9:44 PM
To: [email-masked]
Subject: [Speermint] TLS, etc - Local-policy versus WG mandate

Regards,

Adam

---

From: "Stastny Richard" <[email-masked]>
Date: Thu, 13 Jul 2006 16:57:44 +0200

>the relationships between the members.
 
Just a question: if you do not have a common policy in the federation,
why do you need it at all?
 
Richard

Von: David Schwartz [mailto:[email-masked]]
Gesendet: Do 13.07.2006 16:05
An: Uzelac, Adam; [email-masked]
Betreff: RE: [Speermint] TLS, etc - Local-policy versus WG mandate

Cheers,

David

-----Original Message-----
From: Uzelac, Adam [mailto:[email-masked]]
Sent: Wednesday, July 12, 2006 9:44 PM
To: [email-masked]
Subject: [Speermint] TLS, etc - Local-policy versus WG mandate

Regards,

Adam

---

From: "David Schwartz" <[email-masked]>
Date: Thu, 13 Jul 2006 18:09:39 +0300

There is value in knowing the affiliation of an entity. I can use this
information to find possible commonalities to possibly enable
communication. For example, it could be that the reason we so not share
a policy group is due to the fact that he supports only 711 and I
support only 723. Once his affiliation was known I could search for a
different entity in the same namespace who may be able to connect us
(e.g. he shares policy with both of us since he can transcode 711 to
723).

David

-----Original Message-----
From: Stastny Richard [mailto:[email-masked]] 
Sent: Thursday, July 13, 2006 5:58 PM
To: David Schwartz; Uzelac, Adam; [email-masked]
Subject: Re: [Speermint] TLS, etc - Local-policy versus WG mandate

 
Richard

Cheers,

David

-----Original Message-----
From: Uzelac, Adam [mailto:[email-masked]]
Sent: Wednesday, July 12, 2006 9:44 PM
To: [email-masked]
Subject: [Speermint] TLS, etc - Local-policy versus WG mandate

Regards,

Adam

---

From: "Stastny Richard" <[email-masked]>
Date: Thu, 13 Jul 2006 17:11:51 +0200

I think there is a confusion about the word namespace
and also about E.164 federations and Speermint federations

What do you mean with namespace?
 
Richard

Von: David Schwartz [mailto:[email-masked]]
Gesendet: Do 13.07.2006 17:09
An: Stastny Richard; Uzelac, Adam; [email-masked]
Betreff: RE: [Speermint] TLS, etc - Local-policy versus WG mandate

David

-----Original Message-----
From: Stastny Richard [mailto:[email-masked]]
Sent: Thursday, July 13, 2006 5:58 PM
To: David Schwartz; Uzelac, Adam; [email-masked]
Subject: Re: [Speermint] TLS, etc - Local-policy versus WG mandate

Richard

Cheers,

David

-----Original Message-----
From: Uzelac, Adam [mailto:[email-masked]]
Sent: Wednesday, July 12, 2006 9:44 PM
To: [email-masked]
Subject: [Speermint] TLS, etc - Local-policy versus WG mandate

Regards,

Adam