Subject: [P2PSIP] Pointer to sipsec draft

From: Dean Willis <[email-masked]>
Date: Fri, 15 Jun 2007 12:47:13 -0500

If SIP is the fundamental protocol of our overlay (like with dSIP)  
and there are peer nodes acting as SIP proxies, then we will we need  
a way to protect sensitive information that is traversing those proxies.

One approach that might work for this is outlined in:

http://www.ietf.org/internet-drafts/draft-gurbani-sip-sipsec-01.txt

--
Dean

_______________________________________________
P2PSIP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/p2psip

---

From: "Victor Pascual Ávila" <[email-masked]>
Date: Sun, 17 Jun 2007 20:19:54 +0200

Hello,

On 15/06/07, Dean Willis <[email-masked]> wrote:
>  we will we need

Is signaling security in the scope of this WG? And media security?
IMHO using security on signaling, media or both depends on using
Stateless or Stateful proxies.

Thanks in advance,
Victor Pascual

---

From: "Victor Pascual Ávila" <[email-masked]>
Date: Sun, 17 Jun 2007 20:49:26 +0200

Hello,

Thanks in advance,
Victor Pascual

---

From: Dean Willis <[email-masked]>
Date: Sun, 17 Jun 2007 17:04:33 -0500

> Stateless or Stateful proxies.

I believe signaling security is clearly in scope, and that media  
security arguably is to the extent that we want to make sure our  
stuff works with the media security layers developed elsewhere, such  
as SRTP/DTLS and ZRTP.

One of the big challenges we had to face in getting the group  
chartered was assuring people that the security issues of P2P systems  
could be resolved in an acceptable way.

--
Dean

---

From: Philip Matthews <[email-masked]>
Date: Mon, 18 Jun 2007 10:32:33 -0400

I think that both are in scope in the sense that we have to figure  
out mechanisms that work.
It may be that the documents that standardize these mechanisms are  
products of other working groups,
but we need to select the mechanisms that we want, and be convinced  
that they provide the
security that we want.

The SIPSEC solution is an example. This is  a SIP WG item, and it was  
created based on the
situation that exists in Client-Server SIP. In P2PSIP, we can look at  
it and decide if we want
to go that route, or take a different path.

- Philip

On 17-Jun-07, at 18:04 , Dean Willis wrote:

> stuff works with the media security layers developed elsewhere,  
> such as SRTP/DTLS and ZRTP.
>
> chartered was assuring people that the security issues of P2P  
> systems could be resolved in an acceptable way.
>
> --
> Dean
>
>

---

From: "DRAGE, Keith \(Keith\)" <[email-masked]>
Date: Mon, 18 Jun 2007 17:25:50 +0200

Just to clarify that the sipsec draft is not yet a SIP WG item. It is something SIP expects to look at and make a decision shortly.

However you are entirely correct that P2PSIP should look at these things and if necessary provide input to other groups.

In particular the P2PSIP charter addressed this very point:

"The work planned for the P2PSIP working group is distinct from, but
requires close participation with other IETF WGs, particularly SIP,
SIPPING, SIMPLE, BEHAVE and MMUSIC. The group cannot modify the 
baseline SIP behavior, define a new version of SIP, or attempt to 
produce a parallel protocol for session establishment. If the group 
determines that any capabilities requiring an extension to SIP are 
needed, the group will seek to define such extensions within the SIP 
working group using the SIP change process (RFC 3427). Similarly, 
existing tools developed in the BEHAVE and MMUSIC groups will be used 
for NAT traversal, with extensions or changes desired to support P2PSIP
presented to the BEHAVE or MMUSIC working groups."

Regards

Keith 

> -----Original Message-----
> From: Philip Matthews [mailto:[email-masked]] 
> Sent: Monday, June 18, 2007 3:33 PM
> To: Victor Pascual Ávila
> Cc: P2PSIP Mailing List
> Subject: Re: [P2PSIP] Pointer to sipsec draft
> 
> I think that both are in scope in the sense that we have to 
> figure out mechanisms that work.
> It may be that the documents that standardize these 
> mechanisms are products of other working groups, but we need 
> to select the mechanisms that we want, and be convinced that 
> they provide the security that we want.
> 
> The SIPSEC solution is an example. This is  a SIP WG item, 
> and it was created based on the situation that exists in 
> Client-Server SIP. In P2PSIP, we can look at it and decide if 
> we want to go that route, or take a different path.
> 
> - Philip
> 
> > security arguably is to the extent that we want to make 
> sure our stuff 
> > works with the media security layers developed elsewhere, such as 
> > SRTP/DTLS and ZRTP.
> >