Subject: [Uta] TLS in SIP

From: "Olle E. Johansson" <[email-masked]>
Date: Tue, 7 Jan 2014 16:06:35 +0100

Hi!

I just wanted to say hi as my name was mentioned earlier. I work quite a lot with SIP and have done some work in trying to figure out what all the SIP RFCs say about TLS for people like me that code stuff. 

Summary: It's confusing.

Seems like "use TLS for confidentiality" is a set of words applied to get through IETF review and get published. In many cases, there are no examples on how to verify a cert with a SIP request. If the authors understood how to use TLS in the code, they did not write it down.

I have also been operating TLS tests at many SIPit test events (www.sipit.net). In those, I've set up tests with expired certificates, CAs unknown to mankind, bad domain names and a few that should succeed. I can't say how many developers who approached me happily saying "I succeeded in all tests and got a lock icon on my phone display". 

There's a lot of work to do and no customers are showing any interest. Hopefully that will change.

I will try to summarize some of this in a document - with quotes from various RFCs. We need to have some guidelines for authors of RFCs - if you suggest TLS, what is needed to be included in your text to explain for developers what to implement and how to implement proper usage.

Luckily we now have a working group for that work :-)

/O