Subject: RE: [Speermint] Security Threats & Solutions

From: "Saverio Niccolini" <[email-masked]>
Date: Fri, 1 Sep 2006 12:08:21 +0200

Hi Reinaldo,

sorry if my answer was too rude. I appreciated your comments
and I just wanted to let the WG know what is the motivation
behind my draft:
-- stimulate discussion (I succeded in it :-) ) 
-- gather input for progressing the work into SPEERMINT-specific 
direction (as you are doing, and I like your suggestion)

I do not agree with the comment that it is too early for this
type of work since:
-- we need to have security-related requirements
-- SPEERMINT has a deliverable on identity and security at the
domain border
-- the chair asked to start such a discussion at the last IETF

I do agree that the draft is just a starting point, but this was
how it was thought.

Cheers,
Saverio

> -----Original Message-----
> From: Reinaldo Penno [mailto:[email-masked]] 
> Sent: Friday, September 01, 2006 2:39 AM
> To: Saverio Niccolini; Jeremy Barkan (DigitalShtick); Hannes 
> Tschofenig; [email-masked]
> Subject: RE: [Speermint] Security Threats & Solutions
> 
> Saverio,
> 
> I hope you do not think people are undermining your work. As 
> I said, it
> has intrinsic value and as Jason mention it will stimulate discussion.
> But I would like us to start thinking about speermint attacks. 
> 
> Now, I read your draft, and in the context of SPEERMINT I suggest the
> following nomenclature. Let me know if you agree.
> 
> a. General SIP attacks that can also be used in the context 
> of SPEERMINT
> 
> b. General SIP attacks that cannot be used in the context of SPEERMINT
> but can be adapted for so.
> 
> c. New attacks that peering brings about. 
> 
> Thanks,
> 
> Reinaldo
> 
> > -----Original Message-----
> > From: Saverio Niccolini [mailto:[email-masked]]
> > Sent: Thursday, August 31, 2006 4:57 AM
> > To: Jeremy Barkan (DigitalShtick); Reinaldo Penno; Hannes 
> Tschofenig;
> > [email-masked]
> > Subject: RE: [Speermint] Security Threats & Solutions
> > 
> > Dear all,
> > 
> > the draft was explicitly requested by WG chairs during last IETF.
> > I agree with you that this is a preliminar work and threats specific
> > to peering need to be in there, please read the sentences 
> in the draft
> > where the objective is explicitly declared and it is inline 
> with what
> > you request (moreover please note that there is no such 
> study on VoIP
> > threats for peering out there and this need some time to be 
> written),
> > I just wanted to submit before the interim meeting in order to
> > stimulate discussion since there are two slots on the topic
> > in agenda.
> > 
> > I am happy if you would like to input SPEERMINT specific 
> threats that
> I
> > can classify and insert into the next version of the draft 
> before the
> > next IETF mmeting in San Diego.
> > 
> > Cheers,
> > Saverio
> > 
> > > -----Original Message-----
> > > From: Jeremy Barkan (DigitalShtick)
> > > [mailto:[email-masked]]
> > > Sent: Thursday, August 31, 2006 11:41 AM
> > > To: 'Reinaldo Penno'; 'Hannes Tschofenig'; [email-masked]
> > > Subject: RE: [Speermint] Security Threats & Solutions
> > >
> > > This sounds like an effort worth doing with VOIPSA.
> > >
> > > -----Original Message-----
> > > From: Reinaldo Penno [mailto:[email-masked]]
> > > Sent: Wednesday, August 30, 2006 8:30 PM
> > > To: Hannes Tschofenig; [email-masked]
> > > Subject: RE: [Speermint] Security Threats & Solutions
> > >
> > > Hello,
> > >
> > > I was going to mention something similar. Reading about known
> attacks
> > > and VoIP security nomenclature is helpful because bring 
> people up to
> > > speed and we all speak the same language but I would be interested
> to
> > > understand the attacks that are _specific_ to SPEERMINT.
> > > Impersonating a
> > > proxy? Malicious Reroute? DNS Hijacking attack when related to
> > > federations? etc, These are just examples I just thought
> > > during the time
> > > it took to write this email.
> > >
> > > Regards,
> > >
> > > Reinaldo
> > >
> > > > -----Original Message-----
> > > > From: Hannes Tschofenig [mailto:[email-masked]]
> > > > Sent: Wednesday, August 30, 2006 11:08 AM
> > > > To: [email-masked]
> > > > Subject: [Speermint] Security Threats & Solutions
> > > >
> > > > Hi all,
> > > >
> > > > why is it necessary to rehash standard VoIP security 
> threats? The
> > > > mentioned/described attacks have been investigated already for a
> > > couple
> > > > of years. Countermeasures have been studied, proposed 
> and already
> > > > published as RFC (or are close to get published).
> > > >
> > > > I hope that I am not the only person that is confused now.
> > > >
> > > > Ciao
> > > > Hannes
> > > >
> > > >
> > > > _______________________________________________
> > > > Speermint mailing list
> > > > [email-masked]
> > > > https://www1.ietf.org/mailman/listinfo/speermint
> > >
> > > _______________________________________________
> > > Speermint mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/speermint
> > >
> > >
> > >
> > > _______________________________________________
> > > Speermint mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/speermint
> > >
> 

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint