Subject: [Uta] TLS in SIP

From: "Olle E. Johansson" <[email-masked]>
Date: Tue, 7 Jan 2014 16:14:17 +0100

Hi!

I just wanted to say hi as my name was mentioned earlier. I work quite a lot with SIP and have done some work in trying to figure out what all the SIP RFCs say about TLS for people like me that code stuff. 

Summary: It's confusing.

Seems like "use TLS for confidentiality" is a set of words applied to get through IETF review and get published. In many cases, there are no examples on how to verify a cert with a SIP request. If the authors understood how to use TLS in the code, they did not write it down.

I have also been operating TLS tests at many SIPit test events (www.sipit.net). In those, I've set up tests with expired certificates, CAs unknown to mankind, bad domain names and a few that should succeed. I can't say how many developers who approached me happily saying "I succeeded in all tests and got a lock icon on my phone display". 

There's a lot of work to do and no customers are showing any interest. Hopefully that will change.

I will try to summarize some of this in a document - with quotes from various RFCs. We need to have some guidelines for authors of RFCs - if you suggest TLS, what is needed to be included in your text to explain for developers what to implement and how to implement proper usage.

Luckily we now have a working group for that work :-)

/O

---

From: "Fabio Pietrosanti (naif)" <[email-masked]>
Date: Tue, 07 Jan 2014 16:18:06 +0100

Hi Olle,

i think that it would be required to provide a guideline for "Security
Auditing" a TLS implementation, then having a group analyzing each
individual products by releasing official "Security Vulnerabilities"
that got assigned a CVE id.

Many Large Enterprise and Government Agencies would never buy a product
that have open, unfixed and reported security vulnerabilities.

Reputation and Market impact could provide a serious stimoulous for all
VoIP's vendor to properly implement TLS security, better than
interoperability.

Fabio

Il 1/7/14, 4:14 PM, Olle E. Johansson ha scritto:
> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta

-- 
Fabio Pietrosanti (naif)
HERMES - Center for Transparency and Digital Human Rights
http://logioshermes.org - http://globaleaks.org - http://tor2web.org

---

From: "Olle E. Johansson" <[email-masked]>
Date: Wed, 8 Jan 2014 10:14:58 +0100

> that got assigned a CVE id.
I don't think that's within the scope of the IETF. Many open source products get this kind of audit all the time.

> VoIP's vendor to properly implement TLS security, better than
While this are good ideas, I would like to start with clearing up implementation guidelines. There is work now to define BCPs on choice of ciphers and digest algorithms in TLS. We need to clarify the use of TLS in many applications, especially in SIP, in order to make it easier for developers to build better products and making it easier for sysadmins to configure properly. After that, we have something to audit in the SIP world.

/O

---

From: "Fabio Pietrosanti (naif)" <[email-masked]>
Date: Wed, 08 Jan 2014 12:01:00 +0100

> While this are good ideas, I would like to start with clearing up implementation guidelines. There is work now to define BCPs on choice of ciphers and digest algorithms in TLS. We need to clarify t…
Are there, in the IETF's rfc space, the set of guidelines on how to
properly implement and verify/test the proper implementation of a TLS stack?

Fabio